diff --git a/sys/vfs/nfs/nfs_socket.c b/sys/vfs/nfs/nfs_socket.c
--- a/sys/vfs/nfs/nfs_socket.c
+++ b/sys/vfs/nfs/nfs_socket.c
@@ -1496,6 +1496,14 @@
 	 */
 	verf_type = fxdr_unsigned(int, *tl++);
 	i = fxdr_unsigned(int32_t, *tl);
+	/* DF-0775: bound verifier length — server-side caps at
+	 * RPCAUTH_MAXSIZ (400); the client must too, otherwise
+	 * nfsm_rndup(i) can signed-overflow to INT_MIN.
+	 */
+	if (i < 0 || i > RPCAUTH_MAXSIZ) {
+		error = EBADRPC;
+		goto nfsmout;
+	}
 	if ((nmp->nm_flag & NFSMNT_KERB) && verf_type == RPCAUTH_KERB4) {
 		error = nfs_savenickauth(nmp, req->r_cred, i, req->r_key,
 					 &info->md, &info->dpos, info->mrep);