--- a/sys/dev/netif/ti/if_ti.c
+++ b/sys/dev/netif/ti/if_ti.c
@@ -508,7 +508,9 @@
 	if (sc->ti_rdata->ti_event_ring == NULL)
 		return;
 
-	while (sc->ti_ev_saved_considx != sc->ti_ev_prodidx.ti_idx) {
+	for (int budget = TI_EVENT_RING_CNT;
+	     sc->ti_ev_saved_considx != sc->ti_ev_prodidx.ti_idx &&
+	     budget > 0; budget--) {
 		e = &sc->ti_rdata->ti_event_ring[sc->ti_ev_saved_considx];
 		switch(e->ti_event) {
 		case TI_EV_LINKSTAT_CHANGED:
@@ -1626,7 +1628,9 @@
 	struct ifnet *ifp = &sc->arpcom.ac_if;
 	struct ti_cmd_desc cmd;
 
-	while(sc->ti_rx_saved_considx != sc->ti_return_prodidx.ti_idx) {
+	for (int budget = TI_RETURN_RING_CNT;
+	     sc->ti_rx_saved_considx != sc->ti_return_prodidx.ti_idx &&
+	     budget > 0; budget--) {
 		struct ti_rx_desc *cur_rx;
 		uint32_t rxidx;
 		struct mbuf *m;
@@ -1726,7 +1730,9 @@
 	 * Go through our tx ring and free mbufs for those
 	 * frames that have been sent.
 	 */
-	while (sc->ti_tx_saved_considx != sc->ti_tx_considx.ti_idx) {
+	for (int budget = TI_TX_RING_CNT;
+	     sc->ti_tx_saved_considx != sc->ti_tx_considx.ti_idx &&
+	     budget > 0; budget--) {
 		uint32_t idx = 0;
 
 		idx = sc->ti_tx_saved_considx;