--- a/sys/dev/netif/msk/if_msk.c
+++ b/sys/dev/netif/msk/if_msk.c
@@ -2892,6 +2892,17 @@
 	ifp = sc_if->msk_ifp;
 
 	/*
+	 * The done index is device-supplied: mskc_handle_events() takes
+	 * it from the NIC-DMA'd status LE (11-bit fields, 0..4095) and
+	 * msk_watchdog() reads the 16-bit STAT_TXAx_RIDX register, while
+	 * the ring holds only MSK_TX_RING_CNT entries.  Reject values
+	 * outside the ring instead of walking (and force-completing)
+	 * the whole in-flight window.
+	 */
+	if (idx < 0 || idx >= MSK_TX_RING_CNT)
+		return;
+
+	/*
 	 * Go through our tx ring and free mbufs for those
 	 * frames that have been sent.
 	 */