--- a/sys/dev/netif/txp/if_txp.c
+++ b/sys/dev/netif/txp/if_txp.c
@@ -670,6 +670,16 @@
 		/* retrieve stashed pointer */
 		sd = rxd->rx_sd;
 
+		/*
+		 * The frame length is firmware-fed DMA state; never let a
+		 * faulty/malicious 3XP processor push m_copydata() past the
+		 * receive cluster (DF-4231).
+		 */
+		if (rxd->rx_len < ETHER_MIN_LEN || rxd->rx_len > MCLBYTES) {
+			IFNET_STAT_INC(ifp, ierrors, 1);
+			goto next;
+		}
+
 		m = sd->sd_mbuf;
 		sd->sd_mbuf = NULL;