diff --git a/sys/kern/kern_memio.c b/sys/kern/kern_memio.c
--- a/sys/kern/kern_memio.c
+++ b/sys/kern/kern_memio.c
@@ -557,6 +557,13 @@
 		break;
 		
 	case MEMRANGE_SET:
+		/*
+		 * Writing memory range attributes requires the device be
+		 * opened FWRITE; mmopen only enforces securelevel for that
+		 * case, so mirror that gate here.
+		 */
+		if ((flags & FWRITE) == 0)
+			return (EPERM);
 		md = (struct mem_range_desc *)kmalloc(sizeof(struct mem_range_desc),
 						    M_MEMDESC, M_WAITOK);
 		error = copyin(mo->mo_desc, md, sizeof(struct mem_range_desc));