--- a/sys/dev/acpica/acpi_package.c
+++ b/sys/dev/acpica/acpi_package.c
@@ -91,11 +91,31 @@
 	return (EINVAL);
     }
 
+    /*
+     * ACPI_TYPE_BUFFER payloads are not NUL-terminated (ACPICA copies
+     * exactly Buffer.Length bytes into the external object), so
+     * strlcpy() would scan past the end of the buffer looking for a
+     * terminator.  Truncate the copy at the first NUL or at the end of
+     * the buffer, whichever comes first.
+     */
+    if (obj->Type == ACPI_TYPE_BUFFER) {
+	const char *p = ptr;
+	const char *end = p + obj->Buffer.Length;
+
+	while (p < end && *p != 0)
+	    p++;
+	length = (size_t)(p - (const char *)ptr) + 1;
+    } else {
+	length++;			/* room for terminating NUL */
+    }
+
     /* Make sure string will fit, including terminating NUL */
-    if (++length > size)
+    if (length > size)
 	return (E2BIG);
-
-    strlcpy(dst, ptr, length);
+    if (obj->Type == ACPI_TYPE_BUFFER)
+	memcpy(dst, ptr, length - 1);	/* dst is zeroed above */
+    else
+	strlcpy(dst, ptr, length);
     return (0);
 }