--- a/sys/dev/netif/ix/if_ix.c
+++ b/sys/dev/netif/ix/if_ix.c
@@ -2983,6 +3009,21 @@
 			--count;
 
 		/*
+		 * The descriptor length is NIC-DMA'd and must never be
+		 * trusted to fit the cluster posted for this descriptor
+		 * (rx_mbuf_sz, see ix_init_rx_ring()).  A hostile or
+		 * faulty NIC writing wb.upper.length > rx_mbuf_sz would
+		 * otherwise publish an mbuf whose m_len/m_pkthdr.len run
+		 * past the cluster and leak kernel heap to the network
+		 * stack (same class as DF-3604/DF-3639/DF-3663).
+		 */
+		if (__predict_false(len > rxr->rx_mbuf_sz)) {
+			IFNET_STAT_INC(ifp, ierrors, 1);
+			ix_rx_discard(rxr, i, eop);
+			goto next_desc;
+		}
+
+		/*
 		 * Make sure bad packets are discarded
 		 */
 		if ((staterr & IXGBE_RXDADV_ERR_FRAME_ERR_MASK) ||