diff --git a/sys/vfs/ntfs/ntfs_vfsops.c b/sys/vfs/ntfs/ntfs_vfsops.c
index 0000000..1111111
@@ -457,7 +457,11 @@
 			j = 0;
 			do {
 				ntmp->ntm_ad[i].ad_name[j] = ad.ad_name[j];
-			} while(ad.ad_name[j++]);
+			} while(ad.ad_name[j++] &&
+			    j < (int)sizeof(ntmp->ntm_ad[i].ad_name));
+			/* DF-0871: force NUL-termination within the fixed-size buffer
+			 * so the wchar->char walk can never overrun ntvattrdef.ad_name. */
+			ntmp->ntm_ad[i].ad_name[sizeof(ntmp->ntm_ad[i].ad_name) - 1] = '\0';
 			ntmp->ntm_ad[i].ad_namelen = j - 1;
 			ntmp->ntm_ad[i].ad_type = ad.ad_type;
 		}