--- a/sys/libprop/prop_object.c
+++ b/sys/libprop/prop_object.c
@@ -389,7 +389,9 @@
 		return (false);
 
 	if (*cp == '!') {
-		if (cp[1] != '-' || cp[2] != '-')
+		/* validate each byte before the (possibly widened) test */
+		if (_PROP_EOF(cp[1]) || cp[1] != '-' ||
+		    _PROP_EOF(cp[2]) || cp[2] != '-')
 			return (false);
 		/*
 		 * Comment block -- only allowed if we are allowed to
@@ -736,7 +738,17 @@
 		if (_PROP_EOF(*xml) || *xml != '<')
 			goto bad;
 
-#define	MATCH(str)	(memcmp(&xml[1], str, sizeof(str) - 1) == 0)
+		/*
+		 * The MATCH() comparisons below may read several bytes at
+		 * once (block memcmp / compiler-widened loads).  Reject the
+		 * end-of-buffer case up front and use strncmp(), which by
+		 * definition stops at a NUL in either operand and therefore
+		 * can never scan past the sentinel.
+		 */
+		if (_PROP_EOF(xml[1]))
+			goto bad;
+
+#define	MATCH(str)	(strncmp(&xml[1], str, sizeof(str) - 1) == 0)
 
 		/*
 		 * Skip over the XML preamble that Apple XML property