--- a/sys/dev/netif/mxge/if_mxge.c
+++ b/sys/dev/netif/mxge/if_mxge.c
@@ -772,6 +772,8 @@
 	int i;
 
 	buf = (uint32_t *)((unsigned long)(buf_bytes + 7) & ~7UL);
+	/* don't leak kernel stack bytes to the device */
+	bzero(buf_bytes, sizeof(buf_bytes));
 
 	/* Clear confirmation addr */
 	confirm = (volatile uint32_t *)sc->cmd;
@@ -936,6 +938,8 @@
 	int status, i;
 
 	buf = (uint32_t *)((unsigned long)(buf_bytes + 7) & ~7UL);
+	/* don't leak kernel stack bytes to the device */
+	bzero(buf_bytes, sizeof(buf_bytes));
 
 	size = sc->sram_size;
 	status = mxge_load_firmware_helper(sc, &size);
@@ -3616,6 +3620,8 @@
 		old_down_cnt = sc->down_cnt;
 		wmb();
 
+		/* don't leak kernel stack to the device */
+		bzero(&cmd, sizeof(cmd));
 		err = mxge_send_cmd(sc, MXGEFW_CMD_ETHERNET_DOWN, &cmd);
 		if (err)
 			if_printf(ifp, "Couldn't bring down link\n");