--- a/sys/bus/u4b/serial/ulpt.c
+++ b/sys/bus/u4b/serial/ulpt.c
@@ -176,16 +176,19 @@ ulpt_reset(struct ulpt_softc *sc)
 	/*
 	 * There was a mistake in the USB printer 1.0 spec that gave the
 	 * request type as UT_WRITE_CLASS_OTHER; it should have been
 	 * UT_WRITE_CLASS_INTERFACE.  Many printers use the old one,
 	 * so we try both.
+	 *
+	 * DF-5437: bound each request so an evil printer cannot stretch
+	 * open() (unprivileged, /dev/ulptN is 0644) to ~2x2 s of
+	 * uninterruptible "WXFER" sleep per open.  SOFT_RESET carries no
+	 * data; 250 ms is ample for a functional printer to answer.
 	 */
 
 	lockmgr(&sc->sc_lock, LK_EXCLUSIVE);
 	req.bmRequestType = UT_WRITE_CLASS_OTHER;
 	if (usbd_do_request_flags(sc->sc_udev, &sc->sc_lock,
-	    &req, NULL, 0, NULL, 2 * USB_MS_HZ)) {	/* 1.0 */
+	    &req, NULL, 0, NULL, USB_MS_HZ / 4)) {	/* 1.0 */
 		req.bmRequestType = UT_WRITE_CLASS_INTERFACE;
 		if (usbd_do_request_flags(sc->sc_udev, &sc->sc_lock,
-		    &req, NULL, 0, NULL, 2 * USB_MS_HZ)) {	/* 1.1 */
+		    &req, NULL, 0, NULL, USB_MS_HZ / 4)) {	/* 1.1 */
 			/* ignore error */
 		}
 	}
 	lockmgr(&sc->sc_lock, LK_RELEASE);
 }