--- a/sys/vfs/isofs/cd9660/cd9660_rrip.c
+++ b/sys/vfs/isofs/cd9660/cd9660_rrip.c
@@ -286,6 +286,22 @@
 static void
 cd9660_rrip_defname(struct iso_directory_record *isodir, ISO_RRIP_ANALYZE *ana)
 {
+	/*
+	 * The default name replaces everything any previous NM fragment has
+	 * written: rewind the output pointer to the start of the caller's
+	 * buffer.  This matters when the SUSP walk ends with a dangling NM
+	 * CONTINUE chain -- cd9660_rrip_altname() has already advanced
+	 * ana->outbuf (and *ana->outlen), but the walk terminated (end of
+	 * the system-use area, an ST entry, a CE bounds break or a cleared
+	 * fields word) without a terminating NM fragment, so this fallback
+	 * fires with ana->outbuf pointing up to NAME_MAX bytes into the
+	 * buffer; writing the translated ISO name there overflows
+	 * altname[NAME_MAX] on the cd9660_lookup() stack and the
+	 * isoreaddir d_name area on the cd9660_readdir() heap path.  With
+	 * no NM seen at all both deltas are 0 and this is a no-op.
+	 */
+	ana->outbuf -= *ana->outlen;
+	*ana->outlen = 0;
 	isofntrans(isodir->name,isonum_711(isodir->name_len),
 		   ana->outbuf,ana->outlen,
 		   1,isonum_711(isodir->flags)&4, ana->imp->joliet_level,