--- a/sys/dev/netif/ral/rt2661.c	2026-09-17 06:16:59.148778118 +0000
+++ b/sys/dev/netif/ral/rt2661.c	2026-09-17 06:16:59.148778118 +0000
@@ -1100,6 +1100,12 @@ rt2661_rx_intr(struct rt2661_softc *sc)
 		/* finalize mbuf */
 		m->m_pkthdr.len = m->m_len =
 		    (le32toh(desc->flags) >> 16) & 0xfff;
+		if (m->m_pkthdr.len > MCLBYTES) {
+			/* device-fed 12-bit length vs 2KB cluster */
+			DPRINTFN(sc, 1, "rx frame too large (%d)\n",
+			    m->m_pkthdr.len);
+			m->m_pkthdr.len = m->m_len = MCLBYTES;
+		}
 
 		rssi = rt2661_get_rssi(sc, desc->rssi);
 		/* Error happened during RSSI conversion. */