diff --git a/sys/platform/pc64/x86_64/machdep.c b/sys/platform/pc64/x86_64/machdep.c
@@ -3104,6 +3104,16 @@
 fill_dbregs(struct lwp *lp, struct dbreg *dbregs)
 {
 	struct pcb *pcb;
+	int i;
+
+	/*
+	 * struct dbreg carries 16 dr slots, but only dr[0]-dr[7] are
+	 * defined by the architecture.  Zero the reserved dr[8]-dr[15]
+	 * so we do not leak kernel stack residue back to userspace via
+	 * /proc/<pid>/dbregs or PT_GETDBREGS.  See DF-0993.
+	 */
+	for (i = 8; i < nitems(dbregs->dr); i++)
+		dbregs->dr[i] = 0;
 
 	if (lp == NULL) {
 		dbregs->dr[0] = rdr0();