diff --git a/sys/vfs/nfs/krpc_subr.c b/sys/vfs/nfs/krpc_subr.c
--- a/sys/vfs/nfs/krpc_subr.c
+++ b/sys/vfs/nfs/krpc_subr.c
@@ -422,7 +422,21 @@
 	}
 	reply = mtod(m, struct rpc_reply *);
 	if (reply->rp_auth.authtype != 0) {
-		len += fxdr_unsigned(u_int32_t, reply->rp_auth.authlen);
+		u_int32_t authlen = fxdr_unsigned(u_int32_t,
+						 reply->rp_auth.authlen);
+		/*
+		 * Bound the verifier length: authlen is attacker-controlled
+		 * (network RPC reply).  Without this check, a crafted value
+		 * >= 0x7FFFFFE8 overflows the signed `int len` below to
+		 * INT_MIN and corrupts the mbuf via m_adj().  This mirrors
+		 * the guard already present on the normal NFS socket path
+		 * (nfs_socket.c).
+		 */
+		if (authlen > RPCAUTH_MAXSIZ) {
+			error = EBADRPC;
+			goto out;
+		}
+		len += authlen;
 		len = (len + 3) & ~3; /* XXX? */
 	}
 	m_adj(m, len);