--- sys/kern/tty_pty.c.orig
+++ sys/kern/tty_pty.c
@@ -173,7 +173,7 @@
 	 * If this limit is reached, we don't clone and return an error
 	 * to devfs.
 	 */
-	unit = devfs_clone_bitmap_get(&DEVFS_CLONE_BITMAP(pty), MAXPTYS);
+	unit = devfs_clone_bitmap_get(&DEVFS_CLONE_BITMAP(pty), MAXPTYS - 1);
 
 	if (unit < 0) {
 		ap->a_dev = NULL;
@@ -588,6 +588,18 @@
 		pti_done(pti);
 		lwkt_reltoken(&tp->t_token);
 		lwkt_reltoken(&pti->pt_tty.t_token);
+		return (EIO);
+	}
+
+	/*
+	 * Once the previous master closed while the slave side is still
+	 * open the pty is dead: do not let an unrelated process adopt
+	 * the stale master device (session hijack).
+	 */
+	if (pti->pt_flags & PF_SOPEN) {
+		pti_done(pti);
+		lwkt_reltoken(&tp->t_token);
+		lwkt_reltoken(&pti->pt_tty.t_token);
 		return (EIO);
 	}