diff --git a/sys/dev/usb/net/if_ure.c b/sys/dev/usb/net/if_ure.c
--- a/sys/dev/usb/net/if_ure.c
+++ b/sys/dev/usb/net/if_ure.c
@@ -707,7 +707,13 @@
 				/* set the necessary flags for rx checksum */
 				ure_rxcsum(caps, &pkt, m);
 
-				uether_rxmbuf(ue, m, len - ETHER_CRC_LEN);
+				/*
+				 * len has been known to be bogus at times,
+				 * which leads to problems when passed to
+				 * uether_rxmbuf().  Better understanding why we
+				 * can get there make for good future work.
+				 */
+				uether_rxmbuf(ue, m, 0);
 			}
 
 			off += roundup(len, URE_RXPKT_ALIGN);
diff --git a/sys/dev/usb/net/usb_ethernet.c b/sys/dev/usb/net/usb_ethernet.c
--- a/sys/dev/usb/net/usb_ethernet.c
+++ b/sys/dev/usb/net/usb_ethernet.c
@@ -593,7 +593,14 @@
 	/* finalize mbuf */
 	if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
 	m->m_pkthdr.rcvif = ifp;
-	m->m_pkthdr.len = m->m_len = len;
+	if (len != 0) {
+		/*
+		 * This is going to get it wrong for an mbuf chain, so let's
+		 * make sure we're not doing that.
+		 */
+		MPASS(m->m_next == NULL);
+		m->m_pkthdr.len = m->m_len = len;
+	}
 
 	/* enqueue for later when the lock can be released */
 	(void)mbufq_enqueue(&ue->ue_rxq, m);