--- a/sys/dev/netif/igb/if_igb.c
+++ b/sys/dev/netif/igb/if_igb.c
@@ -2742,6 +2742,22 @@
 			int len;
 
 			len = le16toh(cur->wb.upper.length);
+			/*
+			 * The write-back length is DMA'ed by the NIC and
+			 * must not be trusted.  The buffer posted for this
+			 * descriptor is a single MCLBYTES cluster, front
+			 * trimmed by ETHER_ALIGN when the link MTU fits in
+			 * it (see igb_newbuf()); a length beyond the posted
+			 * buffer would make m_len/m_pkthdr.len walk past
+			 * the mbuf data (OOB read up to ~63.5KB past the
+			 * cluster).  Discard obviously bogus frames.
+			 */
+			if (__predict_false(len >
+			    (rxr->sc->max_frame_size <= MCLBYTES - ETHER_ALIGN ?
+			    MCLBYTES - ETHER_ALIGN : MCLBYTES))) {
+				IFNET_STAT_INC(ifp, ierrors, 1);
+				goto discard;
+			}
 			if ((rxr->sc->hw.mac.type == e1000_i350 ||
 			     rxr->sc->hw.mac.type == e1000_i354) &&
 			    (staterr & E1000_RXDEXT_STATERR_LB))