diff --git a/sys/dev/drm/drm_sysctl.c b/sys/dev/drm/drm_sysctl.c
--- a/sys/dev/drm/drm_sysctl.c
+++ b/sys/dev/drm/drm_sysctl.c
@@ -287,10 +287,13 @@
 	    "\na pid      magic     ioctls\n");
 	for (i = 0; i < privcount; i++) {
 		priv = &tempprivs[i];
-		DRM_SYSCTL_PRINT("%c %5d %10u %10lu\n",
+		/* DF-2020: do not expose per-fd DRM auth magic tokens
+		 * (drm_getmagic shared secrets) via the world-readable
+		 * hw.dri.N.clients sysctl. */
+		DRM_SYSCTL_PRINT("%c %5d %10s %10lu\n",
 			       priv->authenticated ? 'y' : 'n',
 			       priv->pid,
-			       priv->magic,
+			       "-",
 			       0UL);
 	}