--- sys/vfs/tmpfs/tmpfs_vnops.c
+++ sys/vfs/tmpfs/tmpfs_vnops.c
@@ -690,6 +690,18 @@
 
 	if (vp->v_type != VREG)
 		return (EINVAL);
+
+	/*
+	 * Reject negative write offsets.  sys_extpwrite() passes the
+	 * user-supplied offset through unvalidated; because uio_resid is
+	 * an unsigned size_t, the limit checks below wrap mod 2^64 for
+	 * negative offsets and can drive tmpfs_reg_resize() with a
+	 * negative size (KKASSERT panic on INVARIANTS kernels).
+	 * tmpfs_read() already performs the mirror-image check.
+	 */
+	if (uio->uio_offset < 0)
+		return (EINVAL);
+
 	seqcount = ap->a_ioflag >> IO_SEQSHIFT;
 
 	TMPFS_NODE_LOCK(node);