--- a/sys/dev/netif/txp/if_txp.c
+++ b/sys/dev/netif/txp/if_txp.c
@@ -1124,7 +1124,15 @@
 
 	txp_set_filter(sc);
 
-	txp_rxring_fill(sc);
+	/*
+	 * Never enable the receiver over a half-filled buffer ring (DF-4233):
+	 * stale rb_paddrlo entries point at freed clusters and the firmware
+	 * still trusts the old hv_rx_buf_write_idx.
+	 */
+	if (txp_rxring_fill(sc) != 0) {
+		if_printf(ifp, "unable to fill rx ring; leaving interface down\n");
+		return;
+	}
 
 	txp_command(sc, TXP_CMD_TX_ENABLE, 0, 0, 0, NULL, NULL, NULL, 1);
 	txp_command(sc, TXP_CMD_RX_ENABLE, 0, 0, 0, NULL, NULL, NULL, 1);