--- a/sys/dev/virtual/virtio/net/if_vtnet.c	2026-09-17 05:19:20.552939020 +0000
+++ b/sys/dev/virtual/virtio/net/if_vtnet.c	2026-09-17 05:19:35.688746841 +0000
@@ -1660,7 +1660,16 @@
 			goto fail;
 		}
 
-		if (m->m_len < len)
+		/*
+		 * The device fully controls the used-ring length, and
+		 * virtqueue_dequeue() stores it through a uint32_t* while
+		 * we own an int. A length >= 0x80000000 therefore shows up
+		 * negative here; the old signed clamp let it through and
+		 * installed a negative m_len / pkthdr.len mbuf chain into
+		 * the network stack. Clamp unsigned so any insane length
+		 * collapses to the buffer size.
+		 */
+		if ((uint32_t)len > (uint32_t)m->m_len)
 			len = m->m_len;
 
 		m->m_len = len;