diff --git a/sys/kern/sysv_shm.c b/sys/kern/sysv_shm.c
--- a/sys/kern/sysv_shm.c
+++ b/sys/kern/sysv_shm.c
@@ -420,8 +420,13 @@
 	switch (uap->cmd) {
 	case IPC_STAT:
 		error = ipcperm(p, &shmseg->shm_perm, IPC_R);
-		if (error == 0)
-			error = copyout(shmseg, uap->buf, sizeof(inbuf));
+		if (error == 0) {
+			/* Do not leak the in-kernel shm_internal pointer. */
+			struct shmid_ds outbuf;
+			outbuf = *shmseg;
+			outbuf.shm_internal = NULL;
+			error = copyout(&outbuf, uap->buf, sizeof(outbuf));
+		}
 		break;
 	case IPC_SET:
 		error = ipcperm(p, &shmseg->shm_perm, IPC_M);