Index: sys/dev/drm/drmP.h
===================================================================
--- sys/dev/drm/drmP.h
+++ sys/dev/drm/drmP.h
@@ -956,7 +956,7 @@
 static __inline__ void *
 drm_calloc(size_t nmemb, size_t size, struct malloc_type *area)
 {
-	return malloc(size * nmemb, area, M_NOWAIT | M_ZERO);
+	return mallocarray(nmemb, size, area, M_NOWAIT | M_ZERO);
 }
 
 static __inline__ void *
Index: sys/dev/drm/drm_bufs.c
===================================================================
--- sys/dev/drm/drm_bufs.c
+++ sys/dev/drm/drm_bufs.c
@@ -466,8 +466,8 @@
 
 	entry = &dma->bufs[order];
 
-	entry->buflist = malloc(count * sizeof(*entry->buflist), DRM_MEM_BUFS,
-	    M_NOWAIT | M_ZERO);
+	entry->buflist = mallocarray(count, sizeof(*entry->buflist),
+	    DRM_MEM_BUFS, M_NOWAIT | M_ZERO);
 	if (!entry->buflist) {
 		return ENOMEM;
 	}
Index: sys/dev/drm/drm_drawable.c
===================================================================
--- sys/dev/drm/drm_drawable.c
+++ sys/dev/drm/drm_drawable.c
@@ -135,8 +135,8 @@
 			return 0;
 		}
 		if (info->rects == NULL) {
-			info->rects = malloc(sizeof(*info->rects) *
-			    update->num, DRM_MEM_DRAWABLE, M_NOWAIT);
+			info->rects = mallocarray(update->num,
+			    sizeof(*info->rects), DRM_MEM_DRAWABLE, M_NOWAIT);
 			if (info->rects == NULL) {
 				DRM_SPINUNLOCK(&dev->drw_lock);
 				return ENOMEM;
Index: sys/dev/drm/drm_irq.c
===================================================================
--- sys/dev/drm/drm_irq.c
+++ sys/dev/drm/drm_irq.c
@@ -128,7 +128,7 @@
 	callout_init_mtx(&dev->vblank_disable_timer, &dev->vbl_lock, 0);
 	dev->num_crtcs = num_crtcs;
 
-	dev->vblank = malloc(sizeof(struct drm_vblank_info) * num_crtcs,
+	dev->vblank = mallocarray(num_crtcs, sizeof(struct drm_vblank_info),
 	    DRM_MEM_DRIVER, M_NOWAIT | M_ZERO);
 	if (!dev->vblank)
 	    goto err;
Index: sys/dev/drm/drm_sysctl.c
===================================================================
--- sys/dev/drm/drm_sysctl.c
+++ sys/dev/drm/drm_sysctl.c
@@ -175,8 +175,8 @@
 	TAILQ_FOREACH(map, &dev->maplist, link)
 		mapcount++;
 
-	tempmaps = malloc(sizeof(drm_local_map_t) * mapcount, DRM_MEM_DRIVER,
-	    M_NOWAIT);
+	tempmaps = mallocarray(mapcount, sizeof(drm_local_map_t),
+	    DRM_MEM_DRIVER, M_NOWAIT);
 	if (tempmaps == NULL) {
 		DRM_UNLOCK();
 		return ENOMEM;
@@ -238,7 +238,7 @@
 	}
 	DRM_SPINLOCK(&dev->dma_lock);
 	tempdma = *dma;
-	templists = malloc(sizeof(int) * dma->buf_count, DRM_MEM_DRIVER,
+	templists = mallocarray(dma->buf_count, sizeof(int), DRM_MEM_DRIVER,
 	    M_NOWAIT);
 	for (i = 0; i < dma->buf_count; i++)
 		templists[i] = dma->buflist[i]->list;
@@ -289,8 +289,8 @@
 	TAILQ_FOREACH(priv, &dev->files, link)
 		privcount++;
 
-	tempprivs = malloc(sizeof(struct drm_file) * privcount, DRM_MEM_DRIVER,
-	    M_NOWAIT);
+	tempprivs = mallocarray(privcount, sizeof(struct drm_file),
+	    DRM_MEM_DRIVER, M_NOWAIT);
 	if (tempprivs == NULL) {
 		DRM_UNLOCK();
 		return ENOMEM;
Index: sys/dev/drm2/drm_fb_helper.c
===================================================================
--- sys/dev/drm2/drm_fb_helper.c
+++ sys/dev/drm2/drm_fb_helper.c
@@ -512,14 +512,15 @@
 
 	INIT_LIST_HEAD(&fb_helper->kernel_fb_list);
 
-	fb_helper->crtc_info = malloc(crtc_count * sizeof(struct drm_fb_helper_crtc),
-	    DRM_MEM_KMS, M_NOWAIT | M_ZERO);
+	fb_helper->crtc_info = mallocarray(crtc_count,
+	    sizeof(struct drm_fb_helper_crtc), DRM_MEM_KMS, M_NOWAIT | M_ZERO);
 	if (!fb_helper->crtc_info)
 		return -ENOMEM;
 
 	fb_helper->crtc_count = crtc_count;
-	fb_helper->connector_info = malloc(dev->mode_config.num_connector * sizeof(struct drm_fb_helper_connector *),
-	    DRM_MEM_KMS, M_NOWAIT | M_ZERO);
+	fb_helper->connector_info = mallocarray(dev->mode_config.num_connector,
+	    sizeof(struct drm_fb_helper_connector *), DRM_MEM_KMS,
+	    M_NOWAIT | M_ZERO);
 	if (!fb_helper->connector_info) {
 		free(fb_helper->crtc_info, DRM_MEM_KMS);
 		return -ENOMEM;
@@ -528,7 +529,7 @@
 
 	for (i = 0; i < crtc_count; i++) {
 		fb_helper->crtc_info[i].mode_set.connectors =
-			malloc(max_conn_count *
+			mallocarray(max_conn_count,
 				sizeof(struct drm_connector *),
 				DRM_MEM_KMS, M_NOWAIT | M_ZERO);
 
@@ -1269,7 +1270,7 @@
 	if (modes[n] == NULL)
 		return best_score;
 
-	crtcs = malloc(dev->mode_config.num_connector *
+	crtcs = mallocarray(dev->mode_config.num_connector,
 			sizeof(struct drm_fb_helper_crtc *), DRM_MEM_KMS, M_NOWAIT | M_ZERO);
 	if (!crtcs)
 		return best_score;
@@ -1340,11 +1341,11 @@
 	width = dev->mode_config.max_width;
 	height = dev->mode_config.max_height;
 
-	crtcs = malloc(dev->mode_config.num_connector *
+	crtcs = mallocarray(dev->mode_config.num_connector,
 			sizeof(struct drm_fb_helper_crtc *), DRM_MEM_KMS, M_NOWAIT | M_ZERO);
-	modes = malloc(dev->mode_config.num_connector *
+	modes = mallocarray(dev->mode_config.num_connector,
 			sizeof(struct drm_display_mode *), DRM_MEM_KMS, M_NOWAIT | M_ZERO);
-	enabled = malloc(dev->mode_config.num_connector *
+	enabled = mallocarray(dev->mode_config.num_connector,
 			  sizeof(bool), DRM_MEM_KMS, M_NOWAIT | M_ZERO);
 	if (!crtcs || !modes || !enabled) {
 		DRM_ERROR("Memory allocation failed\n");
Index: sys/dev/drm2/drm_irq.c
===================================================================
--- sys/dev/drm2/drm_irq.c
+++ sys/dev/drm2/drm_irq.c
@@ -216,37 +216,37 @@
 
 	dev->num_crtcs = num_crtcs;
 
-	dev->_vblank_count = malloc(sizeof(atomic_t) * num_crtcs,
+	dev->_vblank_count = mallocarray(num_crtcs, sizeof(atomic_t), 
 	    DRM_MEM_VBLANK, M_NOWAIT);
 	if (!dev->_vblank_count)
 		goto err;
 
-	dev->vblank_refcount = malloc(sizeof(atomic_t) * num_crtcs,
+	dev->vblank_refcount = mallocarray(num_crtcs, sizeof(atomic_t),
 	    DRM_MEM_VBLANK, M_NOWAIT);
 	if (!dev->vblank_refcount)
 		goto err;
 
-	dev->vblank_enabled = malloc(num_crtcs * sizeof(int),
+	dev->vblank_enabled = mallocarray(num_crtcs, sizeof(int),
 	    DRM_MEM_VBLANK, M_NOWAIT | M_ZERO);
 	if (!dev->vblank_enabled)
 		goto err;
 
-	dev->last_vblank = malloc(num_crtcs * sizeof(u32),
+	dev->last_vblank = mallocarray(num_crtcs, sizeof(u32),
 	    DRM_MEM_VBLANK, M_NOWAIT | M_ZERO);
 	if (!dev->last_vblank)
 		goto err;
 
-	dev->last_vblank_wait = malloc(num_crtcs * sizeof(u32),
+	dev->last_vblank_wait = mallocarray(num_crtcs, sizeof(u32),
 	    DRM_MEM_VBLANK, M_NOWAIT | M_ZERO);
 	if (!dev->last_vblank_wait)
 		goto err;
 
-	dev->vblank_inmodeset = malloc(num_crtcs * sizeof(int),
+	dev->vblank_inmodeset = mallocarray(num_crtcs, sizeof(int),
 	    DRM_MEM_VBLANK, M_NOWAIT | M_ZERO);
 	if (!dev->vblank_inmodeset)
 		goto err;
 
-	dev->_vblank_time = malloc(num_crtcs * DRM_VBLANKTIME_RBSIZE *
+	dev->_vblank_time = mallocarray(num_crtcs, DRM_VBLANKTIME_RBSIZE *
 	    sizeof(struct timeval), DRM_MEM_VBLANK, M_NOWAIT | M_ZERO);
 	if (!dev->_vblank_time)
 		goto err;
Index: sys/dev/drm2/drm_mem_util.h
===================================================================
--- sys/dev/drm2/drm_mem_util.h
+++ sys/dev/drm2/drm_mem_util.h
@@ -39,7 +39,7 @@
 	if (size != 0 && nmemb > SIZE_MAX / size)
 		return NULL;
 
-	return malloc(nmemb * size, DRM_MEM_DRIVER, M_NOWAIT | M_ZERO);
+	return (mallocarray(nmemb, size, DRM_MEM_DRIVER, M_NOWAIT | M_ZERO));
 }
 
 /* Modeled after cairo's malloc_ab, it's like calloc but without the zeroing. */
@@ -48,7 +48,7 @@
 	if (size != 0 && nmemb > SIZE_MAX / size)
 		return NULL;
 
-	return malloc(nmemb * size, DRM_MEM_DRIVER, M_NOWAIT);
+	return (mallocarray(nmemb, size, DRM_MEM_DRIVER, M_NOWAIT));
 }
 
 static __inline void drm_free_large(void *ptr)
Index: sys/dev/drm2/drm_scatter.c
===================================================================
--- sys/dev/drm2/drm_scatter.c
+++ sys/dev/drm2/drm_scatter.c
@@ -75,7 +75,7 @@
 
 	size = round_page(request->size);
 	entry->pages = atop(size);
-	entry->busaddr = malloc(entry->pages * sizeof(*entry->busaddr),
+	entry->busaddr = mallocarray(entry->pages, sizeof(*entry->busaddr),
 	    DRM_MEM_SGLISTS, M_NOWAIT | M_ZERO);
 	if (!entry->busaddr) {
 		free(entry, DRM_MEM_DRIVER);
Index: sys/dev/drm2/drm_sysctl.c
===================================================================
--- sys/dev/drm2/drm_sysctl.c
+++ sys/dev/drm2/drm_sysctl.c
@@ -221,7 +221,7 @@
 			mapcount++;
 	}
 
-	tempmaps = malloc(sizeof(*tempmaps) * mapcount, DRM_MEM_DRIVER,
+	tempmaps = mallocarray(mapcount, sizeof(*tempmaps), DRM_MEM_DRIVER,
 	    M_NOWAIT);
 	if (tempmaps == NULL) {
 		DRM_UNLOCK(dev);
@@ -294,7 +294,7 @@
 	}
 	DRM_SPINLOCK(&dev->dma_lock);
 	tempdma = *dma;
-	templists = malloc(sizeof(int) * dma->buf_count, DRM_MEM_DRIVER,
+	templists = mallocarray(dma->buf_count, sizeof(int), DRM_MEM_DRIVER,
 	    M_NOWAIT);
 	for (i = 0; i < dma->buf_count; i++)
 		templists[i] = dma->buflist[i]->list;
@@ -345,8 +345,8 @@
 	list_for_each_entry(priv, &dev->filelist, lhead)
 		privcount++;
 
-	tempprivs = malloc(sizeof(struct drm_file) * privcount, DRM_MEM_DRIVER,
-	    M_NOWAIT);
+	tempprivs = mallocarray(privcount, sizeof(struct drm_file),
+	    DRM_MEM_DRIVER, M_NOWAIT);
 	if (tempprivs == NULL) {
 		DRM_UNLOCK(dev);
 		return ENOMEM;
Index: sys/dev/drm2/i915/i915_irq.c
===================================================================
--- sys/dev/drm2/i915/i915_irq.c
+++ sys/dev/drm2/i915/i915_irq.c
@@ -1296,7 +1296,7 @@
 	error->active_bo = NULL;
 	error->pinned_bo = NULL;
 	if (i) {
-		error->active_bo = malloc(sizeof(*error->active_bo)*i,
+		error->active_bo = mallocarray(i, sizeof(*error->active_bo),
 					   DRM_I915_GEM, M_NOWAIT);
 		if (error->active_bo)
 			error->pinned_bo =
Index: sys/dev/drm2/i915/intel_display.c
===================================================================
--- sys/dev/drm2/i915/intel_display.c
+++ sys/dev/drm2/i915/intel_display.c
@@ -8036,13 +8036,13 @@
 	int count;
 
 	config->save_encoder_crtcs =
-		malloc(dev->mode_config.num_encoder *
+		mallocarray(dev->mode_config.num_encoder,
 			sizeof(struct drm_crtc *), DRM_MEM_KMS, M_NOWAIT | M_ZERO);
 	if (!config->save_encoder_crtcs)
 		return -ENOMEM;
 
 	config->save_connector_encoders =
-		malloc(dev->mode_config.num_connector *
+		mallocarray(dev->mode_config.num_connector,
 			sizeof(struct drm_encoder *), DRM_MEM_KMS, M_NOWAIT | M_ZERO);
 	if (!config->save_connector_encoders)
 		return -ENOMEM;
Index: sys/dev/drm2/radeon/radeon_atombios.c
===================================================================
--- sys/dev/drm2/radeon/radeon_atombios.c
+++ sys/dev/drm2/radeon/radeon_atombios.c
@@ -2042,8 +2042,9 @@
 		num_modes = ATOM_MAX_NUMBEROF_POWER_BLOCK;
 	if (num_modes == 0)
 		return state_index;
-	rdev->pm.power_state = malloc(sizeof(struct radeon_power_state) * num_modes,
-	    DRM_MEM_DRIVER, M_NOWAIT | M_ZERO);
+	rdev->pm.power_state = mallocarray(num_modes,
+	    sizeof(struct radeon_power_state), DRM_MEM_DRIVER,
+	    M_NOWAIT | M_ZERO);
 	if (!rdev->pm.power_state)
 		return state_index;
 	/* last mode is usually default, array is low to high */
@@ -2452,9 +2453,9 @@
 	radeon_atombios_add_pplib_thermal_controller(rdev, &power_info->pplib.sThermalController);
 	if (power_info->pplib.ucNumStates == 0)
 		return state_index;
-	rdev->pm.power_state = malloc(sizeof(struct radeon_power_state) *
-				       power_info->pplib.ucNumStates,
-				       DRM_MEM_DRIVER, M_NOWAIT | M_ZERO);
+	rdev->pm.power_state = mallocarray(power_info->pplib.ucNumStates,
+	    sizeof(struct radeon_power_state), DRM_MEM_DRIVER,
+	    M_NOWAIT | M_ZERO);
 	if (!rdev->pm.power_state)
 		return state_index;
 	/* first mode is usually default, followed by low to high */
@@ -2469,10 +2470,11 @@
 			 le16_to_cpu(power_info->pplib.usNonClockInfoArrayOffset) +
 			 (power_state->v1.ucNonClockStateIndex *
 			  power_info->pplib.ucNonClockSize));
-		rdev->pm.power_state[i].clock_info = malloc(sizeof(struct radeon_pm_clock_info) *
-							     ((power_info->pplib.ucStateEntrySize - 1) ?
-							      (power_info->pplib.ucStateEntrySize - 1) : 1),
-							     DRM_MEM_DRIVER, M_NOWAIT | M_ZERO);
+		rdev->pm.power_state[i].clock_info = mallocarray(
+		    sizeof(struct radeon_pm_clock_info),
+		     ((power_info->pplib.ucStateEntrySize - 1) ?
+		      (power_info->pplib.ucStateEntrySize - 1) : 1),
+		     DRM_MEM_DRIVER, M_NOWAIT | M_ZERO);
 		if (!rdev->pm.power_state[i].clock_info)
 			return state_index;
 		if (power_info->pplib.ucStateEntrySize - 1) {
@@ -2554,8 +2556,8 @@
 		 le16_to_cpu(power_info->pplib.usNonClockInfoArrayOffset));
 	if (state_array->ucNumEntries == 0)
 		return state_index;
-	rdev->pm.power_state = malloc(sizeof(struct radeon_power_state) *
-				       state_array->ucNumEntries,
+	rdev->pm.power_state = mallocarray(state_array->ucNumEntries,
+				       sizeof(struct radeon_power_state),
 				       DRM_MEM_DRIVER, M_NOWAIT | M_ZERO);
 	if (!rdev->pm.power_state)
 		return state_index;
@@ -2566,7 +2568,7 @@
 		non_clock_array_index = power_state->v2.nonClockInfoIndex;
 		non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *)
 			&non_clock_info_array->nonClockInfo[non_clock_array_index];
-		rdev->pm.power_state[i].clock_info = malloc(sizeof(struct radeon_pm_clock_info) *
+		rdev->pm.power_state[i].clock_info = mallocarray(sizeof(struct radeon_pm_clock_info),
 							     (power_state->v2.ucNumDPMLevels ?
 							      power_state->v2.ucNumDPMLevels : 1),
 							     DRM_MEM_DRIVER, M_NOWAIT | M_ZERO);
Index: sys/dev/drm2/radeon/radeon_cs.c
===================================================================
--- sys/dev/drm2/radeon/radeon_cs.c
+++ sys/dev/drm2/radeon/radeon_cs.c
@@ -50,12 +50,12 @@
 	p->dma_reloc_idx = 0;
 	/* FIXME: we assume that each relocs use 4 dwords */
 	p->nrelocs = chunk->length_dw / 4;
-	p->relocs_ptr = malloc(p->nrelocs * sizeof(void *),
+	p->relocs_ptr = mallocarray(p->nrelocs, sizeof(void *),
 	    DRM_MEM_DRIVER, M_NOWAIT | M_ZERO);
 	if (p->relocs_ptr == NULL) {
 		return -ENOMEM;
 	}
-	p->relocs = malloc(p->nrelocs * sizeof(struct radeon_cs_reloc),
+	p->relocs = mallocarray(p->nrelocs, sizeof(struct radeon_cs_reloc),
 	    DRM_MEM_DRIVER, M_NOWAIT | M_ZERO);
 	if (p->relocs == NULL) {
 		return -ENOMEM;
@@ -181,7 +181,7 @@
 	p->chunk_relocs_idx = -1;
 	p->chunk_flags_idx = -1;
 	p->chunk_const_ib_idx = -1;
-	p->chunks_array = malloc(cs->num_chunks * sizeof(uint64_t),
+	p->chunks_array = mallocarray(cs->num_chunks, sizeof(uint64_t),
 	    DRM_MEM_DRIVER, M_NOWAIT | M_ZERO);
 	if (p->chunks_array == NULL) {
 		return -ENOMEM;
@@ -193,7 +193,7 @@
 	}
 	p->cs_flags = 0;
 	p->nchunks = cs->num_chunks;
-	p->chunks = malloc(p->nchunks * sizeof(struct radeon_cs_chunk),
+	p->chunks = mallocarray(p->nchunks, sizeof(struct radeon_cs_chunk),
 	    DRM_MEM_DRIVER, M_NOWAIT | M_ZERO);
 	if (p->chunks == NULL) {
 		return -ENOMEM;
Index: sys/dev/drm2/radeon/radeon_gart.c
===================================================================
--- sys/dev/drm2/radeon/radeon_gart.c
+++ sys/dev/drm2/radeon/radeon_gart.c
@@ -360,15 +360,14 @@
 	DRM_INFO("GART: num cpu pages %u, num gpu pages %u\n",
 		 rdev->gart.num_cpu_pages, rdev->gart.num_gpu_pages);
 	/* Allocate pages table */
-	rdev->gart.pages = malloc(sizeof(void *) * rdev->gart.num_cpu_pages,
+	rdev->gart.pages = mallocarray(rdev->gart.num_cpu_pages, sizeof(void *),
 	    DRM_MEM_DRIVER, M_NOWAIT | M_ZERO);
 	if (rdev->gart.pages == NULL) {
 		radeon_gart_fini(rdev);
 		return -ENOMEM;
 	}
-	rdev->gart.pages_addr = malloc(sizeof(dma_addr_t) *
-					rdev->gart.num_cpu_pages,
-					DRM_MEM_DRIVER, M_NOWAIT | M_ZERO);
+	rdev->gart.pages_addr = mallocarray(rdev->gart.num_cpu_pages,
+	    sizeof(dma_addr_t),	DRM_MEM_DRIVER, M_NOWAIT | M_ZERO);
 	if (rdev->gart.pages_addr == NULL) {
 		radeon_gart_fini(rdev);
 		return -ENOMEM;
Index: sys/dev/drm2/radeon/radeon_ring.c
===================================================================
--- sys/dev/drm2/radeon/radeon_ring.c
+++ sys/dev/drm2/radeon/radeon_ring.c
@@ -622,7 +622,7 @@
 	}
 
 	/* and then save the content of the ring */
-	*data = malloc(size * sizeof(uint32_t), DRM_MEM_DRIVER, M_NOWAIT);
+	*data = mallocarray(size, sizeof(uint32_t), DRM_MEM_DRIVER, M_NOWAIT);
 	if (!*data) {
 		sx_xunlock(&rdev->ring_lock);
 		return 0;
Index: sys/dev/drm2/radeon/radeon_test.c
===================================================================
--- sys/dev/drm2/radeon/radeon_test.c
+++ sys/dev/drm2/radeon/radeon_test.c
@@ -70,7 +70,8 @@
 		n -= rdev->ih.ring_size;
 	n /= size;
 
-	gtt_obj = malloc(n * sizeof(*gtt_obj), DRM_MEM_DRIVER, M_NOWAIT | M_ZERO);
+	gtt_obj = mallocarray(n, sizeof(*gtt_obj), DRM_MEM_DRIVER,
+	    M_NOWAIT | M_ZERO);
 	if (!gtt_obj) {
 		DRM_ERROR("Failed to allocate %d pointers\n", n);
 		r = 1;