--- a/sys/dev/misc/syscons/scmouse.c
+++ b/sys/dev/misc/syscons/scmouse.c
@@ -82,14 +82,21 @@
 sc_alloc_cut_buffer(scr_stat *scp, int wait)
 {
     u_char *p;
+    int size;
 
-    if ((cut_buffer == NULL)
-	|| (cut_buffer_size < scp->xsize * scp->ysize + 1)) {
+    /*
+     * mouse_cut() appends one '\r' per fully-selected screen line and a
+     * trailing NUL; a full-screen selection therefore writes up to
+     * xsize*ysize + ysize + 1 bytes into cut_buffer.  Account for that
+     * here so the cut can never write past the requested allocation.
+     */
+    size = scp->xsize * scp->ysize + scp->ysize + 1;
+    if ((cut_buffer == NULL) || (cut_buffer_size < size)) {
 	p = cut_buffer;
 	cut_buffer = NULL;
 	if (p != NULL)
 	    kfree(p, M_SYSCONS);
-	cut_buffer_size = scp->xsize * scp->ysize + 1;
+	cut_buffer_size = size;
 	p = kmalloc(cut_buffer_size, M_SYSCONS, (wait) ? M_WAITOK : M_NOWAIT);
 	if (p != NULL)
 	    p[0] = '\0';