diff --git a/sys/dev/video/bktr/bktr_core.c b/sys/dev/video/bktr/bktr_core.c
--- a/sys/dev/video/bktr/bktr_core.c
+++ b/sys/dev/video/bktr/bktr_core.c
@@ -2330,6 +2330,22 @@
 		    ( *(int *)arg >= PIXFMT_TABLE_SIZE ))
 			return( EINVAL );
 
+		/*
+		 * DF-1216: bigbuf was sized by METEORSETGEO using a hardcoded
+		 * Bpp of 2 (line 1657).  Reject any pixel format whose Bpp
+		 * would require a larger buffer than what is currently mapped,
+		 * otherwise video_read() and start_capture() will issue OOB
+		 * reads/writes past bigbuf.
+		 */
+		{
+			size_t need = (size_t)bktr->rows * bktr->cols *
+				      bktr->frames *
+				      pixfmt_table[ *(int *)arg ].public.Bpp;
+			size_t have = (size_t)bktr->alloc_pages * PAGE_SIZE;
+			if (bktr->bigbuf != 0 && need > have)
+				return( EINVAL );
+		}
+
 		bktr->pixfmt          = *(int *)arg;
 		OUTB(bktr, BKTR_COLOR_CTL, (INB(bktr, BKTR_COLOR_CTL) & 0xf0)
 		     | pixfmt_swap_flags( bktr->pixfmt ));