--- a/sys/dev/crypto/rdrand/rdrand.c
+++ b/sys/dev/crypto/rdrand/rdrand.c
@@ -171,6 +171,7 @@
 		add_buffer_randomness_src(arandomness, cnt,
 					  RAND_SRC_RDRAND |
 					  RAND_SRCF_PCPU);
+		explicit_bzero(randomness, sizeof(randomness));
 
 		if (rdrand_debug > 0) {
 			--rdrand_debug;