--- a/sys/kern/kern_sysctl.c
+++ b/sys/kern/kern_sysctl.c
@@ -722,6 +722,8 @@
 {
 	struct sysctl_oid *oidp;
 
+	if (level > CTL_MAXNAME)	/* next[] only has CTL_MAXNAME slots */
+		return (1);
 	*len = level;
 	SLIST_FOREACH(oidp, lsp, oid_link) {
 		*next = oidp->oid_number;