diff --git a/sys/kern/link_elf.c b/sys/kern/link_elf.c
--- a/sys/kern/link_elf.c
+++ b/sys/kern/link_elf.c
@@ -510,6 +510,16 @@
 		error = ENOEXEC;
 		goto out;
 	    }
+	    /*
+	     * DF-0056: p_filesz > p_memsz would overflow the mapsize-sized
+	     * buffer (sized from p_memsz) in vn_rdwr below and underflow the
+	     * bzero length.  Reject malformed segments outright.
+	     */
+	    if (phdr->p_filesz > phdr->p_memsz) {
+		link_elf_error("p_filesz > p_memsz in PT_LOAD");
+		error = ENOEXEC;
+		goto out;
+	    }
 	    segs[nsegs] = phdr;
 	    ++nsegs;
 	    break;