--- a/sys/dev/netif/ae/if_ae.c
+++ b/sys/dev/netif/ae/if_ae.c
@@ -634,6 +634,7 @@
 	struct ae_rxd *rxd;
 	uint16_t flags;
 	int error;
+	int rxbudget = AE_RXD_COUNT_DEFAULT;
 
 	/*
 	 * Syncronize DMA buffers.
@@ -648,6 +649,17 @@
 			break;
 		rxd->flags = htole16(flags & ~AE_RXD_UPDATE);
 
+		/*
+		 * DF-4219 (DF-3990 family): bound the work done per
+		 * interrupt so a faulty/malicious controller that keeps
+		 * AE_RXD_UPDATE set cannot spin this handler forever
+		 * holding ifp->if_serializer.  Remaining descriptors
+		 * re-arm via the next RX interrupt (IMR stays enabled;
+		 * AE_MASTER_IMT_EN moderation).
+		 */
+		if (--rxbudget < 0)
+			break;
+
 		/* Update stats. */
 		ae_update_stats_rx(flags, &sc->stats);