--- a/sys/vfs/hammer2/hammer2_vfsops.c
+++ b/sys/vfs/hammer2/hammer2_vfsops.c
@@ -492,7 +492,21 @@
 			pmp->pfs_types[j] = HAMMER2_PFSTYPE_MASTER;
 		else
 			pmp->pfs_types[j] = ripdata->meta.pfs_type;
-		pmp->pfs_names[j] = kstrdup((const char *)ripdata->filename, M_HAMMER2);
+		/* DF-2624: the on-disk filename array is not guaranteed
+		 * to be NUL-terminated; bound the copy. */
+		{
+			size_t nlen = strnlen((const char *)ripdata->filename,
+					      HAMMER2_INODE_MAXNAME);
+
+			pmp->pfs_names[j] = kmalloc(nlen + 1, M_HAMMER2,
+						    M_WAITOK | M_ZERO);
+			bcopy(ripdata->filename, pmp->pfs_names[j], nlen);
+			if (nlen == HAMMER2_INODE_MAXNAME) {
+				kprintf("hammer2_pfsalloc: PFS filename not "
+					"NUL-terminated (truncated to %d)\n",
+					(int)nlen);
+			}
+		}
 		pmp->pfs_hmps[j] = chain->hmp;
 		hammer2_spin_ex(&pmp->blockset_spin);
 		pmp->pfs_iroot_blocksets[j] = chain->data->ipdata.u.blockset;