--- a/sys/dev/acpica/acpi.c
+++ b/sys/dev/acpica/acpi.c
@@ -3387,6 +3387,25 @@
     case ACPI_TYPE_BUFFER:
 	p->Buffer.Pointer += dest - (UINT8 *)p;
 	break;
+    case ACPI_TYPE_PACKAGE:
+	/*
+	 * Fix up nested objects too: without this, every Elements
+	 * pointer inside a returned Package is copyout()d as a raw
+	 * kernel virtual address (DF-2373).
+	 */
+	{
+	    ACPI_OBJECT *e;
+	    UINT32 i;
+
+	    for (i = 0; i < p->Package.Count; i++) {
+		e = &p->Package.Elements[i];
+		acpi_call_fixup_pointers(e,
+		    dest + (UINT8 *)e - (UINT8 *)p);
+	    }
+	    p->Package.Elements = (ACPI_OBJECT *)
+		((UINT8 *)p->Package.Elements + dest - (UINT8 *)p);
+	}
+	break;
     }
 }