--- a/sys/dev/netif/dc/if_dc.c	2026-09-16 15:24:11.317338270 +0000
+++ b/sys/dev/netif/dc/if_dc.c	2026-09-16 15:24:11.349337868 +0000
@@ -2567,6 +2567,21 @@
 		/* No errors; receive the packet. */	
 		total_len -= ETHER_CRC_LEN;
 
+		/*
+		 * Do not trust FRAMESZ from the descriptor status word: it is
+		 * DMA-written by the device and is a 14-bit field (up to 16383)
+		 * while the posted cluster only holds MCLBYTES -
+		 * sizeof(u_int64_t) bytes.  Drop frames whose length cannot
+		 * fit the cluster (or is not a frame at all).
+		 */
+		if (total_len <= 0 ||
+		    total_len > MCLBYTES - (int)sizeof(u_int64_t)) {
+			IFNET_STAT_INC(ifp, ierrors, 1);
+			dc_newbuf(sc, i, m);
+			DC_INC(i, DC_RX_LIST_CNT);
+			continue;
+		}
+
 #ifdef __x86_64__
 		/*
 		 * On the x86 we do not have alignment problems, so try to