--- a/sys/dev/netif/em/if_em.c	2026-09-15 21:39:34.188447660 +0000
+++ b/sys/dev/netif/em/if_em.c	2026-09-15 21:39:47.816274889 +0000
@@ -3282,6 +3282,17 @@
 		return;
 
 	tdh = E1000_READ_REG(&adapter->hw, E1000_TDH(0));
+	if ((uint32_t)tdh >= (uint32_t)adapter->num_tx_desc) {
+		/*
+		 * Device fault: TX head outside the ring.  Walking the
+		 * ring toward an unreachable index would free every TX
+		 * buffer and then spin forever (KKASSERT at :3302 on
+		 * INVARIANTS builds).  Bail out instead.
+		 */
+		if (gc && adapter->tx_nmbuf > 0)
+			adapter->tx_running = EM_TX_RUNNING;
+		return;
+	}
 	if (tdh == adapter->next_tx_to_clean) {
 		if (gc && adapter->tx_nmbuf > 0)
 			adapter->tx_running = EM_TX_RUNNING;