--- a/sys/kern/kern_clock.c
+++ b/sys/kern/kern_clock.c
@@ -1669,6 +1669,10 @@
 		fapi = (struct pps_fetch_args *)data;
 		if (fapi->tsformat && fapi->tsformat != PPS_TSFMT_TSPEC)
 			return (EINVAL);
+		/* validate before tstohz_low() int truncation */
+		if (fapi->timeout.tv_nsec < 0 ||
+		    fapi->timeout.tv_nsec >= 1000000000L)
+			return (EINVAL);
 		if (fapi->timeout.tv_sec != 0 || fapi->timeout.tv_nsec != 0) {
 			err = pps_fetch_timeout(&fapi->timeout, pps);
 			if (err != 0)