--- a/sys/dev/netif/emx/if_emx.c
+++ b/sys/dev/netif/emx/if_emx.c
@@ -3374,6 +3374,19 @@
 			eop = 0;
 		}
 
+		/*
+		 * Never trust the NIC write-back length: the posted buffer
+		 * is an MCLBYTES cluster, front-trimmed by ETHER_ALIGN when
+		 * max_frame_size <= MCLBYTES - ETHER_ALIGN (see emx_newbuf()).
+		 * A faulty or malicious device may write any 16-bit value
+		 * into the descriptor; without this check m_len/m_pkthdr.len
+		 * would claim up to ~63.5KB in a 2048-byte cluster.
+		 */
+		if (len == 0 ||
+		    len > MCLBYTES - (rdata->sc->hw.mac.max_frame_size <=
+		    MCLBYTES - ETHER_ALIGN ? ETHER_ALIGN : 0))
+			goto discard;
+
 		if (!(staterr & E1000_RXDEXT_ERR_FRAME_ERR_MASK)) {
 			uint16_t vlan = 0;
 			uint32_t mrq, rss_hash;