diff --git a/sys/dev/misc/kbd/kbd.c b/sys/dev/misc/kbd/kbd.c
--- a/sys/dev/misc/kbd/kbd.c
+++ b/sys/dev/misc/kbd/kbd.c
@@ -1087,7 +1087,15 @@
 			lwkt_reltoken(&kbd_token);
 			return EINVAL;
 		}
-		kbd->kb_fkeytab[fkeyp->keynum].len = imin(fkeyp->flen, MAXFK);
+		/*
+		 * DF-1503: fkeyarg_t.flen is plain `char` (signed on x86_64).
+		 * Cast through u_char before clamping so flen=-1 does not
+		 * become imin(-1,MAXFK)=-1 -> stored as u_char 255 -> 239-byte
+		 * OOB write of str[16].  Getfkey has the same shape and is
+		 * also fixed.
+		 */
+		kbd->kb_fkeytab[fkeyp->keynum].len =
+		    imin((int)(u_char)fkeyp->flen, MAXFK);
 		bcopy(fkeyp->keydef, kbd->kb_fkeytab[fkeyp->keynum].str,
 		      kbd->kb_fkeytab[fkeyp->keynum].len);
 		break;