diff --git a/kern/subr_sbuf.c b/kern/subr_sbuf.c
--- a/kern/subr_sbuf.c
+++ b/kern/subr_sbuf.c
@@ -153,6 +153,9 @@
 	char *newbuf;
 	int newsize;
 
+	if (addlen < 0)
+		return (-1);
+
 	if (!SBUF_CANEXTEND(s))
 		return (-1);
 	newsize = sbuf_extendsize(s->s_size + addlen);