--- a/sys/dev/netif/vge/if_vge.c
+++ b/sys/dev/netif/vge/if_vge.c
@@ -1265,8 +1265,21 @@ vge_rxeof(struct vge_softc *sc, int count)
 		cur_rx = &sc->vge_ldata.vge_rx_list[i];
 		m = sc->vge_ldata.vge_rx_mbuf[i];
 		total_len = VGE_RXBYTES(cur_rx);
 		rxstat = le32toh(cur_rx->vge_sts);
 		rxctl = le32toh(cur_rx->vge_ctl);
+
+		/*
+		 * The BUFSIZ field is DMA-written by the chip; never let
+		 * it exceed the actual cluster size (MCLBYTES), and drop
+		 * degenerate lengths before they reach
+		 * m_len/pkthdr.len (DF-3604 length-trust family).
+		 */
+		if (total_len > MCLBYTES - VGE_ETHER_ALIGN)
+			total_len = MCLBYTES - VGE_ETHER_ALIGN;
+		if (total_len <= ETHER_CRC_LEN) {
+			IFNET_STAT_INC(ifp, ierrors, 1);
+			vge_newbuf(sc, i, m);
+			VGE_RX_DESC_INC(i);
+			continue;
+		}
 
 		/* Invalidate the RX mbuf and unload its map */
 		bus_dmamap_sync(sc->vge_ldata.vge_mtag,