--- a/sys/dev/netif/nge/if_nge.c
+++ b/sys/dev/netif/nge/if_nge.c
@@ -1223,6 +1230,21 @@
 		m = cur_rx->nge_mbuf;
 		cur_rx->nge_mbuf = NULL;
 		total_len = NGE_RXBYTES(cur_rx);
+
+		/*
+		 * nge_ctl's BUFLEN field is device-written (16 bits) while
+		 * the RX buffer is one jumbo minicluster with only
+		 * NGE_JLEN - sizeof(uint64_t) usable bytes: clamp before
+		 * trusting it as an mbuf length, otherwise a faulty or
+		 * hostile NIC produces an m_len of up to 65535 on a 9K
+		 * cluster (OOB read propagated up the stack).
+		 */
+		if (total_len > NGE_JLEN - (int)sizeof(uint64_t)) {
+			IFNET_STAT_INC(ifp, ierrors, 1);
+			nge_newbuf(sc, cur_rx, m);
+			continue;
+		}
+
 		NGE_INC(i, NGE_RX_LIST_CNT);
 		/*
 		 * If an error occurs, update stats, clear the