--- a/sys/dev/video/bktr/bktr_core.c
+++ b/sys/dev/video/bktr/bktr_core.c
@@ -1157,6 +1157,14 @@
 	 * the circular buffer
 	 */
 	readsize = (int)uio->uio_iov->iov_len;
+
+	/* DF-3784: a 64-bit iov_len in [2^31, 2^32) truncates to a
+	 * negative int and bypassed both guards below, making uiomove()
+	 * copy ~2 GiB of kernel memory to userspace. */
+	if (readsize <= 0) {
+		status = EINVAL;
+		goto out;
+	}
 
 	if (readsize > bktr->vbisize) readsize = bktr->vbisize;