--- a/sys/dev/netif/emx/if_emx.c
+++ b/sys/dev/netif/emx/if_emx.c
@@ -2815,6 +2815,16 @@
 		return;
 
 	tdh = E1000_READ_REG(&tdata->sc->hw, E1000_TDH(tdata->idx));
+	if ((uint32_t)tdh >= tdata->num_tx_desc) {
+		/*
+		 * Faulty device or surprise removal: the TDH register read
+		 * returned an out-of-range value (e.g. 0xFFFFFFFF).  Never
+		 * walk the ring toward an unreachable index -- that frees
+		 * every TX buffer and then spins forever under the
+		 * serializer (or trips the KKASSERT below).
+		 */
+		return;
+	}
 	if (tdh == tdata->next_tx_to_clean) {
 		if (gc && tdata->tx_nmbuf > 0)
 			tdata->tx_running = EMX_TX_RUNNING;