--- sys/kern/subr_rman.c	2026-06-29 12:51:19.000000000 +0000
+++ /tmp/opencode/v26/fixtree/sys/kern/subr_rman.c	2026-10-24 16:33:07.741716173 +0000
@@ -211,6 +211,15 @@
 
 	rv = NULL;
 
+	/*
+	 * DF-2855: validate the window before running any arithmetic.
+	 * count-1 > end-start (or a zero count) previously wrapped the
+	 * scan-break test and could grant ranges beyond [start,end] or
+	 * produce inverted r_end < r_start nodes.
+	 */
+	if (count == 0 || start > end || count - 1 > end - start)
+		return (NULL);
+
 	DPRINTF(("rman_reserve_resource: <%s> request: [%#lx, %#lx], length "
 	       "%#lx, flags %u, device %s\n", rm->rm_descr, start, end,
 	       count, flags,