--- a/sys/dev/netif/em/if_em.c	2026-09-15 21:39:34.188447660 +0000
+++ b/sys/dev/netif/em/if_em.c	2026-09-15 21:39:43.468330011 +0000
@@ -3691,6 +3691,20 @@
 		prev_len_adj = 0;
 		desc_len = le16toh(current_desc->length);
 		status = current_desc->status;
+
+		/*
+		 * Validate the write-back length against the buffer we
+		 * actually posted (rx_buffer_len == MCLBYTES).  A faulty
+		 * or malicious device DMA-writing a length beyond the
+		 * posted buffer must not propagate into m_len/
+		 * m_pkthdr.len (heap OOB read of up to ~63.5KB) nor into
+		 * the prev_len_adj fixup (negative m_len).  desc_len == 0
+		 * is also rejected (see DF-1188).
+		 */
+		if (desc_len == 0 || desc_len > adapter->rx_buffer_len) {
+			IFNET_STAT_INC(ifp, ierrors, 1);
+			goto discard;
+		}
 		if (status & E1000_RXD_STAT_EOP) {
 			count--;
 			eop = 1;