diff --git aa/sys/vfs/procfs/procfs_map.c b/procfs_map.c
index 81ccc4e..5f96121 100644
--- aa/sys/vfs/procfs/procfs_map.c
+++ b/procfs_map.c
@@ -72,7 +72,14 @@ procfs_domap(struct proc *curp, struct lwp *lp, struct pfsnode *pfs,
 
 	error = 0;
 
-	if (uio->uio_offset < 0 || uio->uio_resid < 0 || buflen >= INT_MAX)
+	/*
+	 * Overflow-safe bound: uio_offset and uio_resid are both >= 0 here,
+	 * so this rejects every uio_offset + uio_resid >= INT_MAX without a
+	 * signed wraparound of the sum (which would slip past a plain
+	 * `buflen >= INT_MAX' test as a negative value).
+	 */
+	if (uio->uio_offset < 0 || uio->uio_resid < 0 ||
+	    uio->uio_offset > INT_MAX - uio->uio_resid)
 		return EINVAL;
 	sb = sbuf_new (sb, NULL, buflen+1, 0);
 	if (sb == NULL)