--- a/sys/dev/virtual/vmware/vmxnet3/if_vmx.c
+++ b/sys/dev/virtual/vmware/vmxnet3/if_vmx.c
@@ -2315,13 +2315,22 @@ nextp:
 		if (__predict_false(rxq->vxrxq_rs->update_rxhead)) {
 			int qid = rxcd->qid;
 			bus_size_t r;
+			int valid;
 
 			idx = (idx + 1) % rxr->vxrxr_ndesc;
 			if (qid >= sc->vmx_nrxqueues) {
 				qid -= sc->vmx_nrxqueues;
-				r = VMXNET3_BAR0_RXH2(qid);
+				/*
+				 * DF-3781: rxcd->qid is a host-supplied
+				 * 10-bit field.  Only q < nrxqueues is a
+				 * valid ring-1 queue index; anything else
+				 * would index BAR0 far past the register
+				 * file (up to 0xA00 + 1022*8 = 0x29F0 on
+				 * a 4KB BAR0).
+				 */
+				valid = qid < sc->vmx_nrxqueues;
+				r = VMXNET3_BAR0_RXH2(qid);
 			} else
+				valid = 1;
 				r = VMXNET3_BAR0_RXH1(qid);
-			vmxnet3_write_bar0(sc, r, idx);
+			if (valid)
+				vmxnet3_write_bar0(sc, r, idx);
 		}
 	}
 }
*** VERDICT NOTE: identical derived-index discipline applies to the ring
*** selection at if_vmx.c:2217-2220 (covered by DF-3779's guard) — the
*** host must never be allowed to name a queue the guest did not configure.