--- a/sys/bus/cam/scsi/scsi_pt.c
+++ b/sys/bus/cam/scsi/scsi_pt.c
@@ -646,7 +646,9 @@
 			*(int *)addr = 0;
 		break;
 	case PTIOCSETTIMEOUT:
-		if (*(int *)addr < 1) {
+		/* reject values whose *1000 ms product would overflow int
+		 * and silently wrap io_timeout negative (see below) */
+		if (*(int *)addr < 1 || *(int *)addr > 2147483) {
 			error = EINVAL;
 			break;
 		}