--- a/sys/platform/pc64/x86_64/vm_machdep.c
+++ b/sys/platform/pc64/x86_64/vm_machdep.c
@@ -159,6 +159,16 @@
 	bcopy(lp1->lwp_md.md_regs, lp2->lwp_md.md_regs, sizeof(*lp2->lwp_md.md_regs));
 
 	/*
+	 * SECURITY: do not let the child inherit an IOPL grant issued to the
+	 * parent LWP via /dev/io (cpu_set_iopl(), x86_64/sysarch.c).  The
+	 * grant is unaccounted state living only in the parent's trap frame;
+	 * inheriting it leaves the child with full ring-3 port I/O, with no
+	 * /dev/io fd of its own, and (since nothing re-checks it) the grant
+	 * also survives the child's setuid() privilege drop.  Strip it.
+	 */
+	lp2->lwp_md.md_regs->tf_rflags &= ~PSL_IOPL;
+
+	/*
 	 * Set registers for trampoline to user mode.  Leave space for the
 	 * return address on stack.  These are the kernel mode register values.
 	 *