diff --git a/sys/kern/subr_param.c b/sys/kern/subr_param.c
--- a/sys/kern/subr_param.c
+++ b/sys/kern/subr_param.c
@@ -282,6 +282,10 @@
 	TUNABLE_INT_FETCH("kern.maxfiles", &maxfiles);
 	if (maxfiles < 128)
 		maxfiles = 128;
+	/* Upper-bound maxfiles so ncallout = 16 + maxproc + maxfiles
+	 * cannot overflow a signed int. */
+	if (maxfiles > 0x7fffffff - 16 - maxproc)
+		maxfiles = 0x7fffffff - 16 - maxproc;
 
 	/*
 	 * Limit file descriptors so no single user can exhaust the