--- a/sys/dev/netif/ix/ixgbe_mbx.c
+++ b/sys/dev/netif/ix/ixgbe_mbx.c
@@ -231,6 +231,10 @@
 	if (!mbx->ops.read)
 		goto out;
 
+	/* limit read to size of mailbox (mirror ixgbe_read_mbx) */
+	if (size > mbx->size)
+		size = mbx->size;
+
 	ret_val = ixgbe_poll_for_msg(hw, mbx_id);
 
 	/* if ack received read message, otherwise we timed out */
@@ -262,6 +266,14 @@
 	if (!mbx->ops.write || !mbx->timeout)
 		goto out;
 
+	/* exit if the message won't fit the mailbox (mirror ixgbe_write_mbx) */
+	if (size > mbx->size) {
+		ret_val = IXGBE_ERR_MBX;
+		ERROR_REPORT2(IXGBE_ERROR_ARGUMENT,
+			      "Invalid mailbox message size %d", size);
+		goto out;
+	}
+
 	/* send msg */
 	ret_val = mbx->ops.write(hw, msg, size, mbx_id);