diff --git a/sys/dev/video/bktr/bktr_core.c b/sys/dev/video/bktr/bktr_core.c
--- a/sys/dev/video/bktr/bktr_core.c
+++ b/sys/dev/video/bktr/bktr_core.c
@@ -96,6 +96,7 @@
 #include <sys/kernel.h>
 #include <sys/lock.h>
 #include <sys/proc.h>
+#include <sys/caps.h>
 #include <sys/signalvar.h>
 #include <sys/vnode.h>
 #include <sys/bus.h>		/* used by smbus and newbus */
@@ -1201,6 +1202,30 @@
 int
 video_ioctl( bktr_ptr_t bktr, int unit, ioctl_cmd_t cmd, caddr_t arg, struct thread* td )
 {
+	/*
+	 * Hardware-control ioctls that touch the I2C bus, write the
+	 * on-card EEPROM (persistent), toggle GPIO output pins, or talk
+	 * directly to the MSP34xx audio DSP let any local user who can
+	 * open /dev/bktrN (mode 0444) drive tuner PLLs / audio codecs /
+	 * EEPROM at arbitrary device addresses, write persistent EEPROM
+	 * data that survives reboot, mux analog signal paths, and
+	 * reprogram the tuner to out-of-band RF.  Require
+	 * SYSCAP_RESTRICTEDROOT for them.
+	 */
+	switch (cmd) {
+	case BT848_WEEPROM:
+	case BT848_I2CWR:
+	case BT848_GPIO_SET_EN:
+	case BT848_GPIO_SET_DATA:
+	case BT848_MSP_WRITE:
+	case BT848_MSP_RESET:
+		if (caps_priv_check_td(td, SYSCAP_RESTRICTEDROOT))
+			return (EPERM);
+		break;
+	default:
+		break;
+	}
+
 	volatile u_char		c_temp;
 	unsigned int		temp;
 	unsigned int		temp_iform;