diff --git a/sys/vfs/ntfs/ntfs_vnops.c b/sys/vfs/ntfs/ntfs_vnops.c
--- a/sys/vfs/ntfs/ntfs_vnops.c
+++ b/sys/vfs/ntfs/ntfs_vnops.c
@@ -582,9 +582,24 @@
 		if( NULL == iep )
 			break;
 
-		for (; !(iep->ie_flag & NTFS_IEFLAG_LAST);
-			iep = NTFS_NEXTREC(iep, struct attr_indexentry *))
+		for (; (caddr_t)iep >= fp->f_dirblbuf &&
+		     (caddr_t)iep + __offsetof(struct attr_indexentry,
+					       ie_fname) <=
+		     fp->f_dirblbuf + fp->f_dirblsz;
+		     iep = NTFS_NEXTREC(iep, struct attr_indexentry *))
 		{
+			if (iep->ie_flag & NTFS_IEFLAG_LAST)
+				break;
+			/*
+			 * Reject a bogus reclen that would either walk past
+			 * the buffer on the next iteration or stall the loop
+			 * (reclen == 0 -> kernel hang / DoS).
+			 */
+			if (iep->reclen < __offsetof(struct attr_indexentry,
+						     ie_fname)) {
+				error = EINVAL;
+				goto done;
+			}
 			if(!ntfs_isnamepermitted(ntmp,iep))
 				continue;
 			for(i=0, j=0; i < iep->ie_fnamelen; i++, j++) {