--- sys/dev/misc/syscons/syscons.c
+++ sys/dev/misc/syscons/syscons.c
@@ -2002,7 +2002,7 @@
 sccngetch(int flags)
 {
     static struct fkeytab fkey;
-    static int fkeycp;
+    static size_t fkeycp;	/* kbd_get_fkeystr() stores a size_t here */
     scr_stat *scp;
     u_char *p;
     int cur_mode;
@@ -2051,7 +2051,11 @@
     case 0:	/* normal char */
 	return KEYCHAR(c);
     case FKEY:	/* function key */
-	p = kbd_get_fkeystr(scp->sc->kbd, KEYCHAR(c), (size_t *)&fkeycp);
+	p = kbd_get_fkeystr(scp->sc->kbd, KEYCHAR(c), &fkeycp);
+	/* DEFENSIVE: fkeytab[].len is an untrusted u_char (corruptible via
+	 * SETFKEY, see DF-1503); never let it exceed sizeof(fkey.str). */
+	if (fkeycp > sizeof(fkey.str))
+		fkeycp = sizeof(fkey.str);
 	fkey.len = fkeycp;
 	if ((p != NULL) && (fkey.len > 0)) {
 	    bcopy(p, fkey.str, fkey.len);