--- a/sys/dev/netif/mxge/if_mxge.c
+++ b/sys/dev/netif/mxge/if_mxge.c
@@ -2379,6 +2379,16 @@
 		struct mbuf *m;
 		int idx;
 
+		/*
+		 * mcp_idx is NIC-supplied DMA data.  Bound the walk by the
+		 * ring occupancy so a desynced/bogus completion count cannot
+		 * spin forever (or free the whole ring) in interrupt context.
+		 */
+		if (__predict_false(tx->done >= tx->req)) {
+			if_printf(ifp, "bad send completion count %u\n",
+			    (unsigned)mcp_idx);
+			break;
+		}
 		idx = tx->done & tx->mask;
 		tx->done++;