diff --git a/sys/vfs/hammer/hammer_ioctl.c b/sys/vfs/hammer/hammer_ioctl.c
--- a/sys/vfs/hammer/hammer_ioctl.c
+++ b/sys/vfs/hammer/hammer_ioctl.c
@@ -1078,6 +1078,10 @@
 		if (error == 0) {
 			data->leaf = *cursor.leaf;
 			bytes = cursor.leaf->data_len;
+			if (data->size < 0) {
+				error = EINVAL;
+				goto failed;
+			}
 			if (bytes > data->size)
 				bytes = data->size;
 			error = copyout(cursor.data, data->ubuf, bytes);