--- a/sys/vfs/devfs/devfs_helper.c	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/vfs/devfs/devfs_helper.c	2026-10-26 03:29:41.728762178 +0000
@@ -142,7 +142,7 @@
 	unit -= chunk * (sizeof(u_long) * 8);
 
 	lockmgr(&devfs_bitmap_lock, LK_EXCLUSIVE);
-	if (chunk >= bitmap->chunks) {
+	if (unit < 0 || chunk < 0 || chunk >= bitmap->chunks) {
 		lockmgr(&devfs_bitmap_lock, LK_RELEASE);
 		return 0;		/* device does not exist */
 	}
@@ -175,6 +175,8 @@
 	chunk = unit / (sizeof(u_long) * 8);
 	unit -= chunk * (sizeof(u_long) * 8);
 
+	if (unit < 0 || chunk < 0)
+		return -1;
 	lockmgr(&devfs_bitmap_lock, LK_EXCLUSIVE);
 	if (chunk >= bitmap->chunks)
 		devfs_clone_bitmap_extend(bitmap, chunk);
@@ -204,6 +206,8 @@
 	chunk = unit / (sizeof(u_long) * 8);
 	unit -= chunk * (sizeof(u_long) * 8);
 
+	if (unit < 0 || chunk < 0)
+		return;
 	lockmgr(&devfs_bitmap_lock, LK_EXCLUSIVE);
 	if (chunk < bitmap->chunks)
 		bitmap->bitmap[chunk] |= (1UL << unit);