diff --git a/sys/vfs/ufs/ufs_dirhash.c b/sys/vfs/ufs/ufs_dirhash.c
--- a/sys/vfs/ufs/ufs_dirhash.c
+++ b/sys/vfs/ufs/ufs_dirhash.c
@@ -205,6 +205,18 @@
 			goto fail;
 		}
 		if (ep->d_ino != 0) {
+			/*
+			 * Validate that the record is large enough to hold the
+			 * entry's own name.  A crafted entry with d_reclen <
+			 * DIRSIZ(NEWDIRFMT, ep) would cause ufsdirhash_hash to
+			 * read ep->d_namlen bytes from ep->d_name past the
+			 * entry boundary (CWE-125 out-of-bounds read).
+			 */
+			if (ep->d_reclen < DIRSIZ(NEWDIRFMT, ep)) {
+				/* Corrupted directory. */
+				brelse(bp);
+				goto fail;
+			}
 			/* Add the entry (simplified ufsdirhash_add). */
 			slot = ufsdirhash_hash(dh, ep->d_name, ep->d_namlen);
 			while (DH_ENTRY(dh, slot) != DIRHASH_EMPTY)