diff --git a/sys/net/rtsock.c b/sys/net/rtsock.c
--- a/sys/net/rtsock.c
+++ b/sys/net/rtsock.c
@@ -1673,7 +1673,16 @@
 	msglen = rt_msgsize(RTM_GET, &rtinfo);
 
 	w->w_bufsz = msglen * RTTABLE_DUMP_MSGCNT_MAX;
-	w->w_buf = kmalloc(w->w_bufsz, M_TEMP, M_WAITOK | M_NULLOK);
+	/*
+	 * M_ZERO is required: rttable_walk_entry() and rt_msg_buffer() together
+	 * write most rt_msghdr fields but NEVER write rtm_inits (u_long @ off 32)
+	 * nor the 2 bytes of struct padding between rtm_index (u_short @ off 4)
+	 * and rtm_flags (int @ off 8).  Without M_ZERO the buffer carries stale
+	 * M_TEMP slab bytes that are emitted verbatim by SYSCTL_OUT below,
+	 * leaking kernel pointers and other heap residue to any unprivileged
+	 * user that reads sysctl NET_RT_DUMP.  (DF-0388)
+	 */
+	w->w_buf = kmalloc(w->w_bufsz, M_TEMP, M_WAITOK | M_NULLOK | M_ZERO);
 	if (w->w_buf == NULL)
 		return ENOMEM;
 	return 0;