--- a/sys/dev/netif/mxge/if_mxge.c
+++ b/sys/dev/netif/mxge/if_mxge.c
@@ -2232,6 +2232,15 @@
 	idx = rx->cnt & rx->mask;
 	rx->cnt++;
 
+	/*
+	 * The length is NIC-supplied DMA data; never let it describe
+	 * more bytes than the posted cluster actually holds.
+	 */
+	if (__predict_false(len > (uint32_t)rx->cl_size - MXGEFW_PAD)) {
+		IFNET_STAT_INC(ifp, ierrors, 1);
+		return;
+	}
+
 	/* Save a pointer to the received mbuf */
 	m = rx->info[idx].m;