--- a/sys/platform/pc64/x86_64/mp_flame.c
+++ b/sys/platform/pc64/x86_64/mp_flame.c
@@ -133,7 +133,15 @@
 	rbp = (char *)(intptr_t)tf->tf_rbp;
 
 	for (n = 1; n < FLAME_GRAPH_FRAMES - 1; ++n) {
-		if (rbp < bot || rbp > top - 8 || ((intptr_t)rbp & 7))
+		/*
+		 * The frame at rbp spans [rbp, rbp+16): saved %rbp plus
+		 * return address.  rbp+16 must be within the stack, or
+		 * the return-address load at rbp+8 reads up to 8 bytes
+		 * past the end of the kstack allocation (fatal trap 12
+		 * when the adjacent page is unmapped, silent kernel heap
+		 * disclosure into the flame entry when mapped).
+		 */
+		if (rbp < bot || rbp > top - 16 || ((intptr_t)rbp & 7))
 			break;
 		fge->rips[n] = (intptr_t)*(char **)(rbp + 8);
 		if (*(char **)rbp <= rbp)