diff --git a/sys/kern/kern_acl.c b/sys/kern/kern_acl.c
--- a/sys/kern/kern_acl.c
+++ b/sys/kern/kern_acl.c
@@ -93,6 +93,13 @@
 	struct ucred *ucred;
 	int error;
 
+	/*
+	 * Zero the on-stack struct so any entries beyond what VOP_GETACL
+	 * writes (indices [acl_cnt..ACL_MAX_ENTRIES]) are not leaked as
+	 * uninitialized kernel stack to userspace via the copyout below.
+	 * (DF-0185)
+	 */
+	bzero(&inkernelacl, sizeof(inkernelacl));
 	ucred = td->td_ucred;
 	error = VOP_GETACL(vp, type, &inkernelacl, ucred);
 	if (error == 0)