--- a/sys/kern/vfs_subr.c	2026-08-30 10:13:06.133948462 +0000
+++ b/sys/kern/vfs_subr.c	2026-08-30 10:13:13.013861521 +0000
@@ -1985,9 +1985,24 @@
 	int actsize;
 
 	*errorp = 0;
+
+	/*
+	 * Degenerate case: missing or zero-length buffer.  This must
+	 * be checked before strlen(buf); sys_mountctl() leaves buf
+	 * NULL when buflen == 0.
+	 */
+	if (buf == NULL || len == 0) {
+		*errorp = EINVAL;
+		return(0);
+	}
+
 	bwritten = 0;
 	bleft = len - 1;	/* leave room for trailing \0 */
 
+	/* Default flags if no flags passed */
+	if (optp == NULL)
+		optp = optnames;
+
 	/*
 	 * Checks the size of the string. If it contains
 	 * any data, then we will append the new flags to
@@ -1997,15 +2012,6 @@
 	if (actsize > 0)
 		buf += actsize;
 
-	/* Default flags if no flags passed */
-	if (optp == NULL)
-		optp = optnames;
-
-	if (bleft < 0) {	/* degenerate case, 0-length buffer */
-		*errorp = EINVAL;
-		return(0);
-	}
-
 	for (; flags && optp->o_opt; ++optp) {
 		if ((flags & optp->o_opt) == 0)
 			continue;