diff --git a/sys/vfs/isofs/cd9660/cd9660_rrip.c b/sys/vfs/isofs/cd9660/cd9660_rrip.c
--- a/sys/vfs/isofs/cd9660/cd9660_rrip.c
+++ b/sys/vfs/isofs/cd9660/cd9660_rrip.c
@@ -50,6 +50,14 @@
 
 #include <sys/buf2.h>
 
+/*
+ * Maximum number of CE (Continuation Entry) hops followed in the Rock
+ * Ridge SUSP chain.  Well-formed images need only a handful; bounding this
+ * prevents a crafted cyclic CE chain from looping forever in
+ * cd9660_rrip_loop().  (DF-0879)
+ */
+#define	ISO_RRIP_MAX_CE_DEPTH	100
+
 typedef int	rrt_func_t(void *, ISO_RRIP_ANALYZE *ana);
 
 typedef struct {
@@ -476,6 +484,7 @@
 	char *pwhead;
 	u_short c;
 	int result;
+	int ce_count = 0;	/* bound CE continuation chain depth (DF-0879) */
 
 	/*
 	 * Note: If name length is odd,
@@ -557,6 +566,10 @@
 		/*
 		 * Recycle the bp for the continuance into a new block.
 		 */
+		if (++ce_count > ISO_RRIP_MAX_CE_DEPTH) {
+			/* Cyclic or excessively deep CE chain (DF-0879) */
+			break;
+		}
 		if (bp) {
 			brelse(bp);
 			bp = NULL;