--- a/sys/kern/kern_subr.c
+++ b/sys/kern/kern_subr.c
@@ -240,6 +240,14 @@
 		}
 		if (cnt > n)
 			cnt = n;
+		/*
+		 * ZeroPage is exactly PAGE_SIZE bytes (kern_slaballoc.c).
+		 * Never copy more than one page from it per iteration or
+		 * copyout() reads past the allocation and discloses kernel
+		 * heap memory to userspace.
+		 */
+		if (cnt > PAGE_SIZE)
+			cnt = PAGE_SIZE;
 
 		switch (uio->uio_segflg) {
 		case UIO_USERSPACE: