diff --git a/sys/kern/tty_subr.c b/sys/kern/tty_subr.c
--- a/sys/kern/tty_subr.c
+++ b/sys/kern/tty_subr.c
@@ -246,6 +246,10 @@
 	 * there are any characters remaining.
 	 */
 	i = (short *)cp - cl->c_data;
+	if (i < 0 || i >= cl->c_ccmax) {
+		*dst = 0;
+		return NULL;
+	}
 	if (i < cl->c_cchead)
 		i += cl->c_ccmax - cl->c_cchead;
 	else