diff --git a/sys/net/zlib.c b/sys/net/zlib.c
--- a/sys/net/zlib.c
+++ b/sys/net/zlib.c
@@ -3688,6 +3688,12 @@
 
 
 void
+/*
+ * XXX inflate()/inflate_blocks has no decompression-ratio / iteration cap.
+ * A small compressed input can drive a large output.  Output bytes are bounded
+ * by the caller's avail_out, but CPU cost is not; PPP/deflate callers should
+ * additionally cap the compressed input they feed in to avoid CPU DoS.
+ */
 inflate_blocks_reset(inflate_blocks_statef *s, z_streamp z, uLongf *c)
 {
   if (s->checkfn != Z_NULL)