--- a/sys/vfs/isofs/cd9660/cd9660_util.c	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/vfs/isofs/cd9660/cd9660_util.c	2026-10-26 03:30:00.392525197 +0000
@@ -119,11 +119,20 @@
 				if (*fn < '0' || *fn > '9') {
 					return -1;
 				}
+				if (i > 100000000) {
+					/* would overflow int: refuse the
+					 * version field instead of
+					 * matching via modular wrap */
+					return -1;
+				}
 			}
-			for (j = 0; isofn != isoend; j = j * 10 + c - '0')
+			for (j = 0; isofn != isoend; j = j * 10 + c - '0') {
 				isofn += isochar(isofn, isoend,
 						 joliet_level, &c,
 						 NULL, flags, handle);
+				if (j > 100000000)
+					return -1;
+			}
 			return i - j;
 		}
 		if (c != d) {
@@ -204,8 +213,19 @@
 	outp = outbuf;
 
 	if (flags & ISOFSMNT_KICONV && cd9660_iconv) {
+		size_t ic = i;
+
 		cd9660_iconv->convchr(handle, &string, &i, &outp, &j);
-		len -= i;
+		if (i == ic) {
+			/* invalid sequence: convchr consumed NOTHING and
+			 * produced no output - the old code returned c == 0
+			 * without advancing, which isofncmp treats as an
+			 * exact match.  Consume one raw byte instead. */
+			len = 1;
+			string++;
+		} else {
+			len -= i;
+		}
 	} else {
 		len = 1;
 		string++;