--- a/sys/bus/u4b/serial/umoscom.c
+++ b/sys/bus/u4b/serial/umoscom.c
@@ -540,7 +540,14 @@
 umoscom_cfg_read(struct umoscom_softc *sc, uint16_t reg)
 {
 	struct usb_device_request req;
-	uint8_t val;
+	/*
+	 * The usb_error_t result is discarded by every caller, so on a
+	 * timeout, stall, cancel or short/zero-length data stage the vendor
+	 * read must not return uninitialized kernel stack into the TIOCMGET
+	 * modem-status bits (cfg_get_status -> ucom_cfg_status_change ->
+	 * sc_msr -> ucom_modem/ucom_totio -> copyout to userspace).
+	 */
+	uint8_t val = 0;
 
 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
 	req.bRequest = UMOSCOM_READ;