--- a/sys/kern/kern_xio.c	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/kern/kern_xio.c	2026-10-26 00:25:42.789042927 +0000
@@ -102,6 +102,15 @@
     int i;
     int n;
 
+    /*
+     * The byte counters below use int intermediates; reject sizes
+     * that would wrap them instead of corrupting xio_bytes.
+     */
+    if (kbytes > (size_t)INT_MAX) {
+	xio->xio_npages = 0;
+	xio->xio_error = EINVAL;
+	return(xio->xio_error);
+    }
     addr = trunc_page((vm_offset_t)kbase);
     xio->xio_flags = 0;
     xio->xio_offset = (vm_offset_t)kbase & PAGE_MASK;