Index: head/sys/netpfil/ipfw/dn_heap.c
===================================================================
--- head/sys/netpfil/ipfw/dn_heap.c
+++ head/sys/netpfil/ipfw/dn_heap.c
@@ -94,7 +94,7 @@
 #else
 	new_size = (new_size + HEAP_INCREMENT ) & ~HEAP_INCREMENT;
 #endif
-	p = malloc(new_size * sizeof(*p), M_DN_HEAP, M_NOWAIT);
+	p = mallocarray(new_size, sizeof(*p), M_DN_HEAP, M_NOWAIT);
 	if (p == NULL) {
 		printf("--- %s, resize %d failed\n", __func__, new_size );
 		return 1; /* error */
Index: head/sys/netpfil/ipfw/dn_sched_fq_codel.c
===================================================================
--- head/sys/netpfil/ipfw/dn_sched_fq_codel.c
+++ head/sys/netpfil/ipfw/dn_sched_fq_codel.c
@@ -453,8 +453,8 @@
 	q->fs = _si->sched->fs;
 
 	/* allocate memory for flows array */
-	si->flows = malloc(schk->cfg.flows_cnt * sizeof(struct fq_codel_flow),
-		 M_DUMMYNET, M_NOWAIT | M_ZERO);
+	si->flows = mallocarray(schk->cfg.flows_cnt,
+	    sizeof(struct fq_codel_flow), M_DUMMYNET, M_NOWAIT | M_ZERO);
 	if (si->flows == NULL) {
 		D("cannot allocate memory for fq_codel configuration parameters");
 		return ENOMEM ; 
Index: head/sys/netpfil/ipfw/dn_sched_fq_pie.c
===================================================================
--- head/sys/netpfil/ipfw/dn_sched_fq_pie.c
+++ head/sys/netpfil/ipfw/dn_sched_fq_pie.c
@@ -1034,8 +1034,8 @@
 		return ENOMEM ; 
 	}
 	/* allocate memory for flows array */
-	si->si_extra->flows = malloc(schk->cfg.flows_cnt * sizeof(struct fq_pie_flow),
-		 M_DUMMYNET, M_NOWAIT | M_ZERO);
+	si->si_extra->flows = mallocarray(schk->cfg.flows_cnt,
+	    sizeof(struct fq_pie_flow), M_DUMMYNET, M_NOWAIT | M_ZERO);
 	flows = si->si_extra->flows;
 	if (flows == NULL) {
 		free(si->si_extra, M_DUMMYNET);