diff --git a/sys/kern/kern_xio.c b/sys/kern/kern_xio.c
--- a/sys/kern/kern_xio.c
+++ b/sys/kern/kern_xio.c
@@ -232,7 +232,7 @@
     struct lwbuf *lwb;
     struct lwbuf lwb_cache;
 
-    if (uoffset + bytes > xio->xio_bytes)
+    if (uoffset < 0 || bytes < 0 || uoffset + bytes > xio->xio_bytes)
 	return(EFAULT);
 
     offset = (xio->xio_offset + uoffset) & PAGE_MASK;