--- a/sys/dev/netif/lnc/am79900.c	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/dev/netif/lnc/am79900.c	2026-10-26 03:55:24.285175513 +0000
@@ -548,6 +548,14 @@
 		if (m == NULL)
 			break;
 
+		if (m->m_pkthdr.len > LEBLEN - ETHER_CRC_LEN) {
+			/* lance_put has no bound: never hand it an
+			 * oversized chain */
+			ifp->if_oerrors++;
+			m_freem(m);
+			continue;
+		}
+
 		/*
 		 * If BPF is listening on this interface, let it see the packet
 		 * before we commit it to the wire.
--- a/sys/dev/netif/lnc/am7990.c	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/dev/netif/lnc/am7990.c	2026-10-26 03:55:24.309175209 +0000
@@ -511,6 +511,14 @@
 		if (m == NULL)
 			break;
 
+		if (m->m_pkthdr.len > LEBLEN - ETHER_CRC_LEN) {
+			/* lance_put has no bound: never hand it an
+			 * oversized chain */
+			ifp->if_oerrors++;
+			m_freem(m);
+			continue;
+		}
+
 		/*
 		 * If BPF is listening on this interface, let it see the
 		 * packet before we commit it to the wire.