diff --git a/kern/subr_csprng.c b/kern/subr_csprng.c
--- a/kern/subr_csprng.c
+++ b/kern/subr_csprng.c
@@ -130,6 +130,9 @@
 	int cnt;
 	int total_bytes = 0;
 
+	if (bytes < 0)
+		bytes = 0;
+
 again:
 	if (!state->callout_based_reseed &&
 	     ratecheck(&state->last_reseed, &csprng_reseed_interval)) {