--- a/sys/dev/video/bktr/bktr_core.c
+++ b/sys/dev/video/bktr/bktr_core.c
@@ -1761,6 +1761,13 @@
 			return( EBUSY );
 
 		cap_area = (struct bktr_capture_area *) arg;
+		/* DF-3788: zero/negative sizes reach build_dma_prog() which
+		 * divides by x_size*hactive -> kernel divide trap. */
+		if (cap_area->x_offset < 0 || cap_area->y_offset < 0 ||
+		    cap_area->x_size < 2 || cap_area->y_size < 2 ||
+		    cap_area->x_offset + cap_area->x_size > 910 ||
+		    cap_area->y_offset + cap_area->y_size > 576)
+			return (EINVAL);
 		bktr->capture_area_x_offset = cap_area->x_offset;
 		bktr->capture_area_y_offset = cap_area->y_offset;
 		bktr->capture_area_x_size   = cap_area->x_size;