--- a/sys/dev/netif/bge/if_bge.c
+++ b/sys/dev/netif/bge/if_bge.c
@@ -3130,6 +3130,18 @@
 		}
 
 		IFNET_STAT_INC(ifp, ipackets, 1);
+
+		/*
+		 * Bound the NIC-reported frame length by the buffer we
+		 * actually posted (2046/2048 std, 9016/9018 jumbo) before
+		 * any use, including the RX_ALIGNBUG bcopy below.
+		 */
+		if (cur_rx->bge_len < ETHER_HDR_LEN + ETHER_CRC_LEN ||
+		    cur_rx->bge_len > m->m_len + ETHER_CRC_LEN) {
+			IFNET_STAT_INC(ifp, ierrors, 1);
+			m_freem(m);
+			continue;
+		}
 #if !defined(__x86_64__)
 		/*
 		 * The x86 allows unaligned accesses, but for other