diff --git a/sys/vm/vm_swap.c b/sys/vm/vm_swap.c
--- a/sys/vm/vm_swap.c
+++ b/sys/vm/vm_swap.c
@@ -361,9 +361,15 @@
 	 * nblks, nswap, and SWB_DMMAX are PAGE_SIZE'd parameters now, not
 	 * DEV_BSIZE'd.   aligned_nblks is used to calculate the
 	 * size of the swap bitmap, taking into account the stripe size.
+	 *
+	 * SECURITY: Round DOWN, not up.  Rounding up invents up to
+	 * SWB_DMMAX-1 pages (252 KB) of swap space that does not exist
+	 * on the device.  The blist then hands those phantom blocks to
+	 * the swap pager, which issues pageout I/O past the end of the
+	 * device (EINVAL retry livelock on bounds-checking backends,
+	 * silent out-of-bounds writes on backends that do not check).
 	 */
-	aligned_nblks = (swblk_t)((nblks + SWB_DMMASK) &
-				  ~(u_swblk_t)SWB_DMMASK);
+	aligned_nblks = (swblk_t)(nblks & ~(u_swblk_t)SWB_DMMASK);
 	sp->sw_nblks = aligned_nblks;
 
 	if (aligned_nblks * nswdev > nswap)