diff --git a/sys/dev/disk/fd/fd.c b/sys/dev/disk/fd/fd.c
--- a/sys/dev/disk/fd/fd.c
+++ b/sys/dev/disk/fd/fd.c
@@ -2250,6 +2250,14 @@
 	int rv = 0;
 	size_t fdblk;
 
+	/* Validate user-supplied sector count against the fixed
+	 * idfields[FD_MAX_NSEC=36] array. Without this, nsecs > 36
+	 * makes b_bcount = sizeof(fd_idfield_data)*nsecs overflow
+	 * struct fd_formb and the subsequent DMA/bcopy reads past
+	 * the allocation (CVE-class heap OOB read). */
+	if (finfo->fd_formb_nsecs > FD_MAX_NSEC)
+		return (EINVAL);
+
  	fdu	= dkunit(dev);
 	fd	= devclass_get_softc(fd_devclass, fdu);
 	fdblk = 128 << fd->ft.secsize;