diff --git a/sys/dev/video/bktr/bktr_core.c b/sys/dev/video/bktr/bktr_core.c
--- a/sys/dev/video/bktr/bktr_core.c
+++ b/sys/dev/video/bktr/bktr_core.c
@@ -100,6 +100,7 @@
 #include <sys/vnode.h>
 #include <sys/bus.h>		/* used by smbus and newbus */
 #include <sys/thread2.h>
+#include <sys/caps.h>		/* caps_priv_check_td */
 
 #include <vm/vm.h>
 #include <vm/vm_kern.h>
@@ -1395,6 +1396,18 @@
 
 	case METEORSVIDEO:
 		video = (struct meteor_video *)arg;
+		/*
+		 * DF-1215: video->addr becomes the bt848 DMA write target
+		 * (rgb_vbi_prog:2671, rgb_prog:2841, yuvpack_prog:2996,
+		 * yuv422_prog:3114, yuv12_prog:3215).  Setting it to a
+		 * user-chosen physical address gives an unprivileged user
+		 * an arbitrary physical-memory write primitive.  Require
+		 * privilege whenever the caller tries to redirect DMA away
+		 * from the kernel-allocated buffer.
+		 */
+		if (video->addr != 0 &&
+		    caps_priv_check_td(td, SYSCAP_RESTRICTEDROOT) != 0)
+			return (EPERM);
 		bktr->video.addr = video->addr;
 		bktr->video.width = video->width;
 		bktr->video.banksize = video->banksize;