--- a/sys/platform/pc64/x86_64/mp_machdep.c
+++ b/sys/platform/pc64/x86_64/mp_machdep.c
@@ -209,6 +209,25 @@
 	POSTCODE(MP_BOOTADDRESS_POST);
 
 	bootMP_size = mptramp_end - mptramp_start;
+
+	/*
+	 * Sanity check the firmware/loader supplied base memory size (in
+	 * KB, i.e. the end of the first usable SMAP/EFI-map region).  We
+	 * need room for the trampoline plus the three initial page table
+	 * pages below it.  A degenerate value would otherwise wrap the
+	 * unsigned arithmetic below: mptramp_pagetables would become
+	 * ~0xFFFFC000 and init386() would store that into physmap[1],
+	 * making the kernel believe the whole low 4GB (including MMIO/ROM
+	 * holes) is usable RAM.  Fail fast instead, as we already do for
+	 * other malformed firmware tables at boot.
+	 */
+	if (basemem * 1024 < bootMP_size + PAGE_SIZE * 4) {
+		panic("mp_bootaddress: degenerate base memory size %uK "
+		    "(need at least %uK for the AP trampoline)",
+		    basemem,
+		    (unsigned int)howmany(bootMP_size + PAGE_SIZE * 4, 1024));
+	}
+
 	boot_address = trunc_page(basemem * 1024); /* round down to 4k boundary */
 	if (((basemem * 1024) - boot_address) < bootMP_size)
 		boot_address -= PAGE_SIZE;	/* not enough, lower by 4k */