--- a/sys/kern/sys_generic.c
+++ b/sys/kern/sys_generic.c
@@ -671,14 +671,22 @@
 		goto done;
 	}
 
-	if ((com & IOC_VOID) == 0 && size > sizeof(ubuf.stkbuf)) {
-		memp = kmalloc(size, M_IOCTLOPS, M_WAITOK);
+	if (size > sizeof(ubuf.stkbuf)) {
+		memp = kmalloc(size, M_IOCTLOPS, M_WAITOK | M_ZERO);
 		data = memp;
 	} else {
 		memp = NULL;
 		data = ubuf.stkbuf;
 	}
 	if (com & IOC_VOID) {
+		/*
+		 * Zero the buffer for IOC_VOID commands with an IOC_OUT
+		 * component so the copyout below never discloses
+		 * uninitialized kernel stack.  (The heap case is already
+		 * zeroed via M_ZERO.)
+		 */
+		if ((com & IOC_OUT) != 0 && memp == NULL)
+			bzero(data, sizeof(ubuf.stkbuf));
 		*(caddr_t *)data = uspc_data;
 	} else if (com & IOC_IN) {
 		if (size != 0) {