Index: head/lib/libc/gen/ttyname.c
===================================================================
--- head/lib/libc/gen/ttyname.c
+++ head/lib/libc/gen/ttyname.c
@@ -61,6 +61,10 @@
 {
 	size_t used;
 
+	/* Don't write off the end of a zero-length buffer. */
+	if (len < 1)
+		return (ERANGE);
+
 	*buf = '\0';
 
 	/* Must be a terminal. */