diff --git a/sys/kern/subr_scanf.c b/sys/kern/subr_scanf.c
--- a/sys/kern/subr_scanf.c
+++ b/sys/kern/subr_scanf.c
@@ -305,10 +305,13 @@
 				}
 				nread += sum;
 			} else {
-				bcopy(inp, __va_arg(ap, char *), width);
-				inr -= width;
-				inp += width;
-				nread += width;
+				size_t copylen = width;
+				if (copylen > inr)
+					copylen = inr;
+				bcopy(inp, __va_arg(ap, char *), copylen);
+				inr -= copylen;
+				inp += copylen;
+				nread += copylen;
 				nassigned++;
 			}
 			nconversions++;