--- a/sys/dev/netif/age/if_age.c
+++ b/sys/dev/netif/age/if_age.c
@@ -2074,8 +2074,15 @@ age_rxeof(struct age_softc *sc, struct rx_rdesc *rxrd)
 		m = sc->age_cdata.age_rxhead;
 		m->m_flags |= M_PKTHDR;
 		m->m_pkthdr.rcvif = ifp;
-		m->m_pkthdr.len = sc->age_cdata.age_rxlen;
-		/* Set the first mbuf length. */
-		m->m_len = sc->age_cdata.age_rxlen - pktlen;
+		/*
+		 * Hardware-supplied frame length must not exceed what
+		 * the chain can actually hold (cluster size minus the
+		 * ETHER_ALIGN headroom), else m_len/m_pkthdr.len walk
+		 * off the cluster (heap OOB read).
+		 */
+		m->m_pkthdr.len = sc->age_cdata.age_rxlen;
+		m->m_len = sc->age_cdata.age_rxlen - pktlen;
+		if (m->m_pkthdr.len > MCLBYTES - ETHER_ALIGN)
+			m->m_pkthdr.len = m->m_len = MCLBYTES - ETHER_ALIGN;
 
 		/*
 		 * Set checksum information.