--- a/sys/vfs/fuse/fuse_vnops.c
+++ b/sys/vfs/fuse/fuse_vnops.c
@@ -567,6 +567,16 @@
 		vtyp = VFIFO;
 	else
 		vtyp = VBAD;
+
+	/*
+	 * DF-3028: reject S_IFMT values we cannot represent before
+	 * fuse_alloc_node() creates a node whose type hits the
+	 * KKASSERT(0) default in fuse_node_vn().
+	 */
+	if (vtyp == VBAD || vtyp == VNON) {
+		fuse_ipc_put(fip);
+		return EINVAL;
+	}
 
 	error = fuse_alloc_node(fmp, dfnp, feo->nodeid, vtyp, &vp);
 	if (error == 0) {
--- a/sys/vfs/fuse/fuse_node.c
+++ b/sys/vfs/fuse/fuse_node.c
@@ -102,6 +102,8 @@
 	KKASSERT(dfnp->type == VDIR);
 	if (vtyp == VBLK || vtyp == VCHR || vtyp == VFIFO)
 		return EINVAL;
+	if (vtyp == VBAD || vtyp == VNON)	/* DF-3028 */
+		return EINVAL;
 
 	mtx_lock(&fmp->ino_lock);
 	fnp = RB_LOOKUP(fuse_node_tree, &fmp->node_head, ino);