diff --git a/sys/vfs/isofs/cd9660/cd9660_rrip.c b/sys/vfs/isofs/cd9660/cd9660_rrip.c
--- a/sys/vfs/isofs/cd9660/cd9660_rrip.c
+++ b/sys/vfs/isofs/cd9660/cd9660_rrip.c
@@ -507,6 +507,16 @@
 		 * Note: "pend" should be more than one SUSP header
 		 */
 		while (pend >= phead + 1) {
+			/*
+			 * Upper-bound check: the whole SUSP entry (header + h.length
+			 * bytes) must fit within the System Use area before we dispatch
+			 * its handler.  A forged h.length (e.g. NM/SL claiming 255) would
+			 * otherwise make the handler bcopy() past pend and, when the
+			 * record is near a block boundary, past the directory buffer into
+			 * unmapped kernel memory (page fault).  DF-0878.
+			 */
+			if ((char *)phead + isonum_711(phead->length) > (char *)pend)
+				break;
 			if (isonum_711(phead->version) == 1) {
 				for (ptable = table; ptable->func; ptable++) {
 					if (*phead->type == *ptable->type &&