--- a/sys/vfs/ext2fs/ext2_lookup.c
+++ b/sys/vfs/ext2fs/ext2_lookup.c
@@ -493,6 +493,13 @@
 		 * dp->i_offset + dp->i_count.
 		 */
 		if (ss.slotstatus == NONE) {
+			/*
+			 * DF-3084: a crafted directory size >= 2^31 truncates
+			 * negative through doff_t (int32_t); the notfound path
+			 * would otherwise hand ext2_direnter a negative offset.
+			 */
+			if (dp->i_size > 0x7fffffffLL - DIRBLKSIZ)
+				return (EINVAL);
 			dp->i_offset = roundup2(dp->i_size, DIRBLKSIZ);
 			dp->i_count = 0;
 			enduseful = dp->i_offset;