--- a/sys/kern/subr_sbuf.c
+++ b/sys/kern/subr_sbuf.c
@@ -243,6 +243,18 @@
 	KASSERT(error != NULL,
 	    ("%s called with NULL error pointer", __func__));
 
+	/*
+	 * sbuf_new() takes an int length.  Reject resid values for which
+	 * (resid + 1) would not survive the ssize_t -> int conversion:
+	 * anything negative or above INT_MAX - 1 (0x7ffffffe) truncates
+	 * (e.g. resid 0x100000000 -> length 1) while the uiomove() below
+	 * still consumes the full 64-bit resid, overflowing the allocation.
+	 */
+	if (uio->uio_resid < 0 ||
+	    uio->uio_resid > (ssize_t)0x7ffffffeLL) {
+		*error = EINVAL;
+		return (NULL);
+	}
 	s = sbuf_new(s, NULL, uio->uio_resid + 1, 0);
 	if (s == NULL) {
 		*error = ENOMEM;