diff --git a/sys/kern/subr_module.c b/sys/kern/subr_module.c
--- a/sys/kern/subr_module.c
+++ b/sys/kern/subr_module.c
@@ -407,7 +407,9 @@
 
     /* Iterate through the TLV-encoded sections. */
     bptr = (uint32_t *)preload_metadata;
-    while (bptr[0] != MODINFO_END) {
+    while (bptr[0] != MODINFO_END && bptr[1] != 0) {
+	uint32_t adv;
+
 	sbuf_printf(sbp, " %p:\n", bptr);
 
 	type = *bptr++;
@@ -422,7 +424,12 @@
 	preload_modinfo_value(sbp, bptr, type, len);
 	sbuf_putc(sbp, '\n');
 
-	bptr += roundup(len, sizeof(u_long)) / sizeof(uint32_t);
+	/* Bound the advance so a malicious len cannot jump past the
+	 * metadata region. roundup(len, 8)/4 must stay within reason. */
+	adv = roundup(len, sizeof(u_long)) / sizeof(uint32_t);
+	if (adv > 1024 * 1024 / sizeof(uint32_t))
+	    break;
+	bptr += adv;
     }
 }