diff --git a/sys/netinet6/nd6.c b/sys/netinet6/nd6.c
--- a/sys/netinet6/nd6.c
+++ b/sys/netinet6/nd6.c
@@ -2253,7 +2253,11 @@
 					    ip6_sprintf(&pfr->router->rtaddr));
 				advrtrs++;
 			}
-			p->advrtrs = advrtrs;
+			p->advrtrs = advrtrs;  /* total count, reported to user */
+			/* Only entries that fit in buf were written; clamp the
+			 * SYSCTL_OUT length so we do not read past buf. */
+			if ((size_t)advrtrs > (sizeof(buf) - sizeof(*p)) / sizeof(*sin6))
+				advrtrs = (u_short)((sizeof(buf) - sizeof(*p)) / sizeof(*sin6));
 		} else {
 			panic("buffer too short");
 		}