--- a/sys/dev/video/bktr/bktr_core.c
+++ b/sys/dev/video/bktr/bktr_core.c
@@ -1639,7 +1639,7 @@
 			error = EINVAL;
 		}
 
-		if (geo->frames > 32) {
+		if (geo->frames < 1 || geo->frames > 32) {
 			kprintf("%s: ioctl: too many frames.\n",
 			       bktr_name(bktr));
 
@@ -3517,6 +3517,16 @@
 	fp = &format_params[bktr->format_params];
 
 	/*  If requested, clear out capture buf first  */
+	/* DF-3789: defensive check - capture geometry must fit bigbuf */
+	if (bktr->video.addr == 0 &&
+	    (u_long)bktr->rows * bktr->cols *
+		      pixfmt_table[bktr->pixfmt].public.Bpp >
+	    (u_long)bktr->alloc_pages * PAGE_SIZE) {
+		kprintf("%s: capture geometry exceeds buffer\n",
+			bktr_name(bktr));
+		return;
+	}
+
 	if (bktr->clr_on_start && (bktr->video.addr == 0)) {
 		bzero((caddr_t)bktr->bigbuf, 
 		      (size_t)bktr->rows * bktr->cols * bktr->frames *