--- a/sys/vfs/hpfs/hpfs_subr.c
+++ b/sys/vfs/hpfs/hpfs_subr.c
@@ -279,6 +279,7 @@
 	struct cpisec * cpisp;
 	struct cpiblk * cpibp;
 	struct cpdblk * cpdbp;
+	int nsec = 0;
@@ -281,6 +282,10 @@
 	while (cpicnt > 0) {
+		if (++nsec > 16) {
+			kprintf("hpfs_cpinit: cpisec chain too long (cycle?)\n");
+			return (EINVAL);
+		}
 		error = bread(hpmp->hpm_devvp, dbtodoff(lsn), DEV_BSIZE, &bp);
 		if (error) {
 			brelse(bp);
+			kfree(hpmp->hpm_cpdblk, M_HPFSMNT);
 			return (error);
 		}
@@ -295,6 +300,7 @@
 			error = hpfs_cpload(hpmp, cpibp, cpdbp);
 			if (error) {
 				brelse(bp);
+				kfree(hpmp->hpm_cpdblk, M_HPFSMNT);
 				return (error);
 			}
 		}