--- a/sys/dev/netif/ale/if_ale.c
+++ b/sys/dev/netif/ale/if_ale.c
@@ -2203,6 +2203,19 @@
 		sc->ale_cdata.ale_rx_seqno++;
 		length = ALE_RX_BYTES(le32toh(rs->length));
 		status = le32toh(rs->flags);
+		/*
+		 * DF-3989 (DF-3604/3759/3933 family): the 14-bit RRS
+		 * length is controller-DMA'd.  Drop frames whose length
+		 * cannot describe a frame the controller could actually
+		 * have written into this Rx page, instead of letting
+		 * m_devget() copy past the DMA allocation.
+		 */
+		if (length > sc->ale_max_frame_size ||
+		    length < ETHER_HDR_LEN + ETHER_CRC_LEN) {
+			IFNET_STAT_INC(ifp, ierrors, 1);
+			ale_rx_update_page(sc, &rx_page, length, &prod);
+			continue;
+		}
 		if ((status & ALE_RD_ERROR) != 0) {
 			/*
 			 * We want to pass the following frames to upper