--- /tmp/orig/dev/misc/tbridge/tbridge.c	2026-07-23 11:54:56.914864000 +0000
+++ dev/misc/tbridge/tbridge.c	2026-07-23 11:57:17.686283000 +0000
@@ -139,6 +139,10 @@
 	i = kvsnprintf(tbridge_msgbuf_ptr, tbridge_msgbuf_remsz, fmt, args);
 	__va_end(args);
 
+	if ((size_t)i > tbridge_msgbuf_remsz)
+		i = tbridge_msgbuf_remsz;
+	if (i < 0)
+		i = 0;
 	tbridge_msgbuf_ptr += i;
 	tbridge_msgbuf_remsz -= i;
 
@@ -263,6 +267,8 @@
 		break;
 
 	case TBRIDGE_GETRESULT:
+		if (tbridge_curtest == NULL)
+			return EINVAL;
 		error = kthread_create(tbridge_curtest->tb_run, NULL, &td,
 		    "testrunner");
 		if (error)
@@ -271,7 +277,7 @@
 		/* The following won't be called if the thread wasn't created */
 		if (!tbridge_result_ready) {
 			r = tsleep(&tbridge_result_ready, 0, "tbridgeres",
-			    hz * testcase_get_timeout(tbridge_testcase));
+			    imin(hz * testcase_get_timeout(tbridge_testcase), hz * 3600));
 			if (r != 0) {
 				if (tbridge_curtest->tb_abort != NULL)
 					tbridge_curtest->tb_abort();