Index: if_ure.c
===================================================================
RCS file: /cvs/src/sys/dev/usb/if_ure.c,v
retrieving revision 1.21
diff -u -p -r1.21 if_ure.c
--- if_ure.c	14 Oct 2020 23:47:55 -0000	1.21
+++ if_ure.c	23 Mar 2021 10:18:54 -0000
@@ -1896,10 +1896,17 @@ ure_rxeof(struct usbd_xfer *xfer, void *
 			ifp->if_ierrors++;
 			goto done;
 		}
+		if (pktlen < ETHER_MIN_LEN) {
+			DPRINTF(("ethernet frame is too short\n"));
+			ifp->if_ierrors++;
+			goto done;
+		}
 
 		total_len -= roundup(pktlen, URE_RX_BUF_ALIGN);
 		buf += sizeof(rxhdr);
 
+		/* trim fcs */
+		pktlen -= ETHER_CRC_LEN;
 		m = m_devget(buf, pktlen, ETHER_ALIGN);
 		if (m == NULL) {
 			DPRINTF(("unable to allocate mbuf for next packet\n"));