--- a/sys/libprop/prop_data.c
+++ b/sys/libprop/prop_data.c
@@ -582,6 +582,17 @@
 		return (true);
 
 	/*
+	 * Sanity-clamp the blob size: the decoded blob can never be larger
+	 * than the number of characters remaining in the XML document
+	 * (base64 encodes at least one character per output byte).  This
+	 * also rejects strtoul() overflow (whose ERANGE detection does not
+	 * exist in the kernel) and sizes whose +1 allocation would be
+	 * unsatisfiable under M_WAITOK semantics.
+	 */
+	if (len > strlen(ctx->poic_cp))
+		return (true);
+
+	/*
 	 * Always allocate one extra in case we don't land on an even byte
 	 * boundary during the decode.
 	 */