diff --git a/sys/kern/subr_sbuf.c b/sys/kern/subr_sbuf.c
--- a/sys/kern/subr_sbuf.c
+++ b/sys/kern/subr_sbuf.c
@@ -155,6 +155,14 @@
 
 	if (!SBUF_CANEXTEND(s))
 		return (-1);
+	/*
+	 * Guard against integer overflow: s->s_size (ssize_t) + addlen (int)
+	 * can exceed INT_MAX, which would be silently truncated to a negative
+	 * int by sbuf_extendsize(int), yielding a tiny allocation and a heap
+	 * overflow in the memcpy below.  (DF-2552)
+	 */
+	if (addlen < 0 || s->s_size > (ssize_t)0x7fffffff - addlen)
+		return (-1);
 	newsize = sbuf_extendsize(s->s_size + addlen);
 	newbuf = SBMALLOC(newsize);
 	if (newbuf == NULL)