Index: sys/amd64/amd64/bpf_jit_machdep.c
===================================================================
--- sys/amd64/amd64/bpf_jit_machdep.c
+++ sys/amd64/amd64/bpf_jit_machdep.c
@@ -186,7 +186,7 @@
 	/* Allocate the reference table for the jumps. */
 	if (fjmp) {
 #ifdef _KERNEL
-		stream.refs = malloc((nins + 1) * sizeof(u_int), M_BPFJIT,
+		stream.refs = mallocarray(nins + 1, sizeof(u_int), M_BPFJIT,
 		    M_NOWAIT | M_ZERO);
 #else
 		stream.refs = calloc(nins + 1, sizeof(u_int));
Index: sys/arm/xscale/ixp425/if_npe.c
===================================================================
--- sys/arm/xscale/ixp425/if_npe.c
+++ sys/arm/xscale/ixp425/if_npe.c
@@ -515,7 +515,8 @@
 		return error;
 	}
 	/* XXX M_TEMP */
-	dma->buf = malloc(nbuf * sizeof(struct npebuf), M_TEMP, M_NOWAIT | M_ZERO);
+	dma->buf = mallocarray(nbuf, sizeof(struct npebuf), M_TEMP,
+	    M_NOWAIT | M_ZERO);
 	if (dma->buf == NULL) {
 		device_printf(sc->sc_dev,
 		     "unable to allocate memory for %s s/w buffers\n",
Index: sys/arm64/arm64/busdma_bounce.c
===================================================================
--- sys/arm64/arm64/busdma_bounce.c
+++ sys/arm64/arm64/busdma_bounce.c
@@ -302,8 +302,8 @@
 	error = 0;
 
 	if (dmat->segments == NULL) {
-		dmat->segments = (bus_dma_segment_t *)malloc(
-		    sizeof(bus_dma_segment_t) * dmat->common.nsegments,
+		dmat->segments = (bus_dma_segment_t *)mallocarray(
+		    dmat->common.nsegments, sizeof(bus_dma_segment_t)
 		    M_DEVBUF, M_NOWAIT);
 		if (dmat->segments == NULL) {
 			CTR3(KTR_BUSDMA, "%s: tag %p error %d",
Index: sys/cam/cam_queue.c
===================================================================
--- sys/cam/cam_queue.c
+++ sys/cam/cam_queue.c
@@ -126,7 +126,7 @@
 	KASSERT(new_size >= queue->entries, ("camq_resize: "
 	    "New queue size can't accommodate queued entries (%d < %d).",
 	    new_size, queue->entries));
-	new_array = (cam_pinfo **)malloc(new_size * sizeof(cam_pinfo *),
+	new_array = (cam_pinfo **)mallocarray(new_size, sizeof(cam_pinfo *),
 					 M_CAMQ, M_NOWAIT);
 	if (new_array == NULL) {
 		/* Couldn't satisfy request */
Index: sys/cam/ctl/ctl_frontend.c
===================================================================
--- sys/cam/ctl/ctl_frontend.c
+++ sys/cam/ctl/ctl_frontend.c
@@ -172,8 +172,8 @@
 	 * Initialize the initiator and portname mappings
 	 */
 	port->max_initiators = CTL_MAX_INIT_PER_PORT;
-	port->wwpn_iid = malloc(sizeof(*port->wwpn_iid) * port->max_initiators,
-	    M_CTL, M_NOWAIT | M_ZERO);
+	port->wwpn_iid = mallocarray(port->max_initiators,
+	    sizeof(*port->wwpn_iid), M_CTL, M_NOWAIT | M_ZERO);
 	if (port->wwpn_iid == NULL) {
 		retval = ENOMEM;
 		goto error;
Index: sys/compat/ndis/subr_ndis.c
===================================================================
--- sys/compat/ndis/subr_ndis.c
+++ sys/compat/ndis/subr_ndis.c
@@ -1351,7 +1351,7 @@
 	block = (ndis_miniport_block *)adapter;
 	sc = device_get_softc(block->nmb_physdeviceobj->do_devext);
 
-	sc->ndis_mmaps = malloc(sizeof(bus_dmamap_t) * physmapneeded,
+	sc->ndis_mmaps = mallocarray(physmapneeded, sizeof(bus_dmamap_t),
 	    M_DEVBUF, M_NOWAIT|M_ZERO);
 
 	if (sc->ndis_mmaps == NULL)
Index: sys/fs/nfsclient/nfs_clvnops.c
===================================================================
--- sys/fs/nfsclient/nfs_clvnops.c
+++ sys/fs/nfsclient/nfs_clvnops.c
@@ -2666,7 +2666,7 @@
 #define	NFS_COMMITBVECSIZ	20
 #endif
 	struct buf *bvec_on_stack[NFS_COMMITBVECSIZ];
-	int bvecsize = 0, bveccount;
+	u_int bvecsize = 0, bveccount;
 
 	if (called_from_renewthread != 0)
 		slptimeo = hz;
Index: sys/geom/uzip/g_uzip_zlib.c
===================================================================
--- sys/geom/uzip/g_uzip_zlib.c
+++ sys/geom/uzip/g_uzip_zlib.c
@@ -132,7 +132,7 @@
 {
         void *ptr;
 
-        ptr = malloc(type * size, M_GEOM_UZIP, M_NOWAIT);
+        ptr = mallocarray(type, size, M_GEOM_UZIP, M_NOWAIT);
 
         return (ptr);
 }
Index: sys/gnu/dev/bwn/phy_n/if_bwn_phy_n_core.c
===================================================================
--- sys/gnu/dev/bwn/phy_n/if_bwn_phy_n_core.c
+++ sys/gnu/dev/bwn/phy_n/if_bwn_phy_n_core.c
@@ -1620,7 +1620,7 @@
 	uint16_t i;
 	uint32_t *data;
 
-	data = malloc(len * sizeof(uint32_t), M_DEVBUF, M_NOWAIT | M_ZERO);
+	data = mallocarray(len, sizeof(uint32_t), M_DEVBUF, M_NOWAIT | M_ZERO);
 	if (!data) {
 		BWN_ERRPRINTF(mac->mac_sc, "allocation for samples loading failed\n");
 		return -ENOMEM;
@@ -1663,7 +1663,8 @@
 		len = bw << 1;
 	}
 
-	samples = malloc(len * sizeof(struct bwn_c32), M_DEVBUF, M_NOWAIT | M_ZERO);
+	samples = mallocarray(len, sizeof(struct bwn_c32), M_DEVBUF,
+	    M_NOWAIT | M_ZERO);
 	if (!samples) {
 		BWN_ERRPRINTF(mac->mac_sc, "allocation for samples generation failed\n");
 		return 0;
Index: sys/i386/i386/bpf_jit_machdep.c
===================================================================
--- sys/i386/i386/bpf_jit_machdep.c
+++ sys/i386/i386/bpf_jit_machdep.c
@@ -185,7 +185,7 @@
 	/* Allocate the reference table for the jumps. */
 	if (fjmp) {
 #ifdef _KERNEL
-		stream.refs = malloc((nins + 1) * sizeof(u_int), M_BPFJIT,
+		stream.refs = mallocarray(nins + 1, sizeof(u_int), M_BPFJIT,
 		    M_NOWAIT | M_ZERO);
 #else
 		stream.refs = calloc(nins + 1, sizeof(u_int));
Index: sys/i386/i386/k6_mem.c
===================================================================
--- sys/i386/i386/k6_mem.c
+++ sys/i386/i386/k6_mem.c
@@ -107,7 +107,7 @@
 
 	sc->mr_cap = 0;
 	sc->mr_ndesc = 2; /* XXX (BFF) For now, we only have one msr for this */
-	sc->mr_desc = malloc(sc->mr_ndesc * sizeof(struct mem_range_desc),
+	sc->mr_desc = mallocarray(sc->mr_ndesc, sizeof(struct mem_range_desc),
 	    M_MEMDESC, M_NOWAIT | M_ZERO);
 	if (sc->mr_desc == NULL)
 		panic("k6_mrinit: malloc returns NULL");
Index: sys/kern/init_main.c
===================================================================
--- sys/kern/init_main.c
+++ sys/kern/init_main.c
@@ -159,7 +159,7 @@
 		count += newsysinit_end - newsysinit;
 	else
 		count += sysinit_end - sysinit;
-	newset = malloc(count * sizeof(*sipp), M_TEMP, M_NOWAIT);
+	newset = mallocarray(count, sizeof(*sipp), M_TEMP, M_NOWAIT);
 	if (newset == NULL)
 		panic("cannot malloc for sysinit");
 	xipp = newset;
Index: sys/kern/kern_cpu.c
===================================================================
--- sys/kern/kern_cpu.c
+++ sys/kern/kern_cpu.c
@@ -444,7 +444,7 @@
 	 * match of settings against each level.
 	 */
 	count = CF_MAX_LEVELS;
-	levels = malloc(count * sizeof(*levels), M_TEMP, M_NOWAIT);
+	levels = mallocarray(count, sizeof(*levels), M_TEMP, M_NOWAIT);
 	if (levels == NULL)
 		return (ENOMEM);
 	error = CPUFREQ_LEVELS(sc->dev, levels, &count);
@@ -969,7 +969,7 @@
 
 	/* Get settings from the device and generate the output string. */
 	set_count = MAX_SETTINGS;
-	sets = malloc(set_count * sizeof(*sets), M_TEMP, M_NOWAIT);
+	sets = mallocarray(set_count, sizeof(*sets), M_TEMP, M_NOWAIT);
 	if (sets == NULL) {
 		sbuf_delete(&sb);
 		return (ENOMEM);
Index: sys/kern/kern_ctf.c
===================================================================
--- sys/kern/kern_ctf.c
+++ sys/kern/kern_ctf.c
@@ -45,7 +45,7 @@
 {
 	void *ptr;
 
-	ptr = malloc(items * size, M_TEMP, M_NOWAIT);
+	ptr = mallocarray(items, size, M_TEMP, M_NOWAIT);
 	return ptr;
 }
 
Index: sys/kern/kern_pmc.c
===================================================================
--- sys/kern/kern_pmc.c
+++ sys/kern/kern_pmc.c
@@ -338,7 +338,8 @@
 		    "range.\n", pmc_softevents);
 		pmc_softevents = PMC_EV_DYN_COUNT;
 	}
-	pmc_softs = malloc(pmc_softevents * sizeof(struct pmc_soft *), M_PMCHOOKS, M_NOWAIT|M_ZERO);
+	pmc_softs = mallocarray(pmc_softevents, sizeof(struct pmc_soft *),
+	    M_PMCHOOKS, M_NOWAIT|M_ZERO);
 	KASSERT(pmc_softs != NULL, ("cannot allocate soft events table"));
 }
 
Index: sys/kern/subr_bus.c
===================================================================
--- sys/kern/subr_bus.c
+++ sys/kern/subr_bus.c
@@ -1464,7 +1464,7 @@
 	device_t *list;
 
 	count = devclass_get_count(dc);
-	list = malloc(count * sizeof(device_t), M_TEMP, M_NOWAIT|M_ZERO);
+	list = mallocarray(count, sizeof(device_t), M_TEMP, M_NOWAIT|M_ZERO);
 	if (!list)
 		return (ENOMEM);
 
@@ -1680,7 +1680,7 @@
 
 		oldlist = dc->devices;
 		newsize = roundup((unit + 1), MINALLOCSIZE / sizeof(device_t));
-		newlist = malloc(sizeof(device_t) * newsize, M_BUS, M_NOWAIT);
+		newlist = mallocarray(newsize, sizeof(device_t), M_BUS, M_NOWAIT);
 		if (!newlist)
 			return (ENOMEM);
 		if (oldlist != NULL)
@@ -2300,7 +2300,7 @@
 		return (0);
 	}
 
-	list = malloc(count * sizeof(device_t), M_TEMP, M_NOWAIT|M_ZERO);
+	list = mallocarray(count, sizeof(device_t), M_TEMP, M_NOWAIT|M_ZERO);
 	if (!list)
 		return (ENOMEM);
 
Index: sys/kern/subr_taskqueue.c
===================================================================
--- sys/kern/subr_taskqueue.c
+++ sys/kern/subr_taskqueue.c
@@ -651,8 +651,8 @@
 	vsnprintf(ktname, sizeof(ktname), name, ap);
 	tq = *tqp;
 
-	tq->tq_threads = malloc(sizeof(struct thread *) * count, M_TASKQUEUE,
-	    M_NOWAIT | M_ZERO);
+	tq->tq_threads = mallocarray(count, sizeof(struct thread *),
+	    M_TASKQUEUE, M_NOWAIT | M_ZERO);
 	if (tq->tq_threads == NULL) {
 		printf("%s: no memory for %s threads\n", __func__, ktname);
 		return (ENOMEM);
Index: sys/kern/subr_vmem.c
===================================================================
--- sys/kern/subr_vmem.c
+++ sys/kern/subr_vmem.c
@@ -692,7 +692,7 @@
 
 	MPASS(newhashsize > 0);
 
-	newhashlist = malloc(sizeof(struct vmem_hashlist) * newhashsize,
+	newhashlist = mallocarray(newhashsize, sizeof(struct vmem_hashlist),
 	    M_VMEM, M_NOWAIT);
 	if (newhashlist == NULL)
 		return ENOMEM;
Index: sys/mips/mips/busdma_machdep.c
===================================================================
--- sys/mips/mips/busdma_machdep.c
+++ sys/mips/mips/busdma_machdep.c
@@ -345,7 +345,8 @@
 	struct sync_list *slist;
 	bus_dmamap_t map;
 
-	slist = malloc(sizeof(*slist) * dmat->nsegments, M_BUSDMA, M_NOWAIT);
+	slist = mallocarray(dmat->nsegments, sizeof(*slist), M_BUSDMA,
+	    M_NOWAIT);
 	if (slist == NULL)
 		return (NULL);
 	map = uma_zalloc_arg(dmamap_zone, dmat, M_NOWAIT);
@@ -534,9 +535,8 @@
 	int error = 0;
 
 	if (dmat->segments == NULL) {
-		dmat->segments = (bus_dma_segment_t *)malloc(
-		    sizeof(bus_dma_segment_t) * dmat->nsegments, M_BUSDMA,
-		    M_NOWAIT);
+		dmat->segments = (bus_dma_segment_t *)malloc(dmat->nsegments,
+		    sizeof(bus_dma_segment_t), M_BUSDMA, M_NOWAIT);
 		if (dmat->segments == NULL) {
 			CTR3(KTR_BUSDMA, "%s: tag %p error %d",
 			    __func__, dmat, ENOMEM);
@@ -647,9 +647,8 @@
 	else
 		mflags = M_WAITOK;
 	if (dmat->segments == NULL) {
-		dmat->segments = (bus_dma_segment_t *)malloc(
-		    sizeof(bus_dma_segment_t) * dmat->nsegments, M_BUSDMA,
-		    mflags);
+		dmat->segments = (bus_dma_segment_t *)malloc(dmat->nsegments,
+		    sizeof(bus_dma_segment_t), M_BUSDMA, mflags);
 		if (dmat->segments == NULL) {
 			CTR4(KTR_BUSDMA, "%s: tag %p tag flags 0x%x error %d",
 			    __func__, dmat, dmat->flags, ENOMEM);
Index: sys/mips/nlm/dev/sec/nlmrsa.c
===================================================================
--- sys/mips/nlm/dev/sec/nlmrsa.c
+++ sys/mips/nlm/dev/sec/nlmrsa.c
@@ -346,7 +346,7 @@
 
 		if (ses == NULL) {
 			sesn = sc->sc_nsessions;
-			ses = malloc((sesn + 1) * sizeof(*ses),
+			ses = mallocarray(sesn + 1, sizeof(*ses),
 			    M_DEVBUF, M_NOWAIT);
 			if (ses == NULL)
 				return (ENOMEM);
@@ -528,8 +528,9 @@
 		goto errout;
 	}
 	cmd->rsafn = 0; /* Mod Exp */
-	cmd->rsasrc = malloc(
-	    cmd->rsaopsize * (krp->krp_iparams + krp->krp_oparams),
+	cmd->rsasrc = mallocarray(
+	    krp->krp_iparams + krp->krp_oparams,
+	    cmd->rsaopsize,
 	    M_DEVBUF,
 	    M_NOWAIT | M_ZERO);
 	if (cmd->rsasrc == NULL) {
Index: sys/net/if_vlan.c
===================================================================
--- sys/net/if_vlan.c
+++ sys/net/if_vlan.c
@@ -479,7 +479,7 @@
 		return;
 
 	/* M_NOWAIT because we're called with trunk mutex held */
-	hash2 = malloc(sizeof(struct ifvlanhead) * n2, M_VLAN, M_NOWAIT);
+	hash2 = mallocarray(n2, sizeof(struct ifvlanhead), M_VLAN, M_NOWAIT);
 	if (hash2 == NULL) {
 		printf("%s: out of memory -- hash size not changed\n",
 		    __func__);
Index: sys/net/iflib.c
===================================================================
--- sys/net/iflib.c
+++ sys/net/iflib.c
@@ -1550,15 +1550,15 @@
 		goto fail;
 	}
 	if (!(txq->ift_sds.ifsd_flags =
-	    (uint8_t *) malloc(sizeof(uint8_t) *
-	    scctx->isc_ntxd[txq->ift_br_offset], M_IFLIB, M_NOWAIT | M_ZERO))) {
+	    (uint8_t *) mallocarray(scctx->isc_ntxd[txq->ift_br_offset],
+	    sizeof(uint8_t), M_IFLIB, M_NOWAIT | M_ZERO))) {
 		device_printf(dev, "Unable to allocate tx_buffer memory\n");
 		err = ENOMEM;
 		goto fail;
 	}
 	if (!(txq->ift_sds.ifsd_m =
-	    (struct mbuf **) malloc(sizeof(struct mbuf *) *
-	    scctx->isc_ntxd[txq->ift_br_offset], M_IFLIB, M_NOWAIT | M_ZERO))) {
+	    (struct mbuf **) mallocarray(scctx->isc_ntxd[txq->ift_br_offset],
+	    sizeof(struct mbuf *), M_IFLIB, M_NOWAIT | M_ZERO))) {
 		device_printf(dev, "Unable to allocate tx_buffer memory\n");
 		err = ENOMEM;
 		goto fail;
@@ -1570,7 +1570,8 @@
 		return (0);
 
 	if (!(txq->ift_sds.ifsd_map =
-	    (bus_dmamap_t *) malloc(sizeof(bus_dmamap_t) * scctx->isc_ntxd[txq->ift_br_offset], M_IFLIB, M_NOWAIT | M_ZERO))) {
+	    (bus_dmamap_t *) mallocarray(scctx->isc_ntxd[txq->ift_br_offset],
+	    sizeof(bus_dmamap_t), M_IFLIB, M_NOWAIT | M_ZERO))) {
 		device_printf(dev, "Unable to allocate tx_buffer map memory\n");
 		err = ENOMEM;
 		goto fail;
@@ -1726,22 +1727,22 @@
 			goto fail;
 		}
 		if (!(fl->ifl_sds.ifsd_flags =
-		      (uint8_t *) malloc(sizeof(uint8_t) *
-					 scctx->isc_nrxd[rxq->ifr_fl_offset], M_IFLIB, M_NOWAIT | M_ZERO))) {
+		      (uint8_t *) mallocarray(scctx->isc_nrxd[rxq->ifr_fl_offset],
+		          sizeof(uint8_t), M_IFLIB, M_NOWAIT | M_ZERO))) {
 			device_printf(dev, "Unable to allocate tx_buffer memory\n");
 			err = ENOMEM;
 			goto fail;
 		}
 		if (!(fl->ifl_sds.ifsd_m =
-		      (struct mbuf **) malloc(sizeof(struct mbuf *) *
-					      scctx->isc_nrxd[rxq->ifr_fl_offset], M_IFLIB, M_NOWAIT | M_ZERO))) {
+		      (struct mbuf **) mallocarray(scctx->isc_nrxd[rxq->ifr_fl_offset],
+		          sizeof(struct mbuf *), M_IFLIB, M_NOWAIT | M_ZERO))) {
 			device_printf(dev, "Unable to allocate tx_buffer memory\n");
 			err = ENOMEM;
 			goto fail;
 		}
 		if (!(fl->ifl_sds.ifsd_cl =
-		      (caddr_t *) malloc(sizeof(caddr_t) *
-					      scctx->isc_nrxd[rxq->ifr_fl_offset], M_IFLIB, M_NOWAIT | M_ZERO))) {
+		      (caddr_t *) mallocarray(scctx->isc_nrxd[rxq->ifr_fl_offset],
+		          sizeof(caddr_t), M_IFLIB, M_NOWAIT | M_ZERO))) {
 			device_printf(dev, "Unable to allocate tx_buffer memory\n");
 			err = ENOMEM;
 			goto fail;
@@ -1753,7 +1754,8 @@
 			continue;
 
 		if (!(fl->ifl_sds.ifsd_map =
-		      (bus_dmamap_t *) malloc(sizeof(bus_dmamap_t) * scctx->isc_nrxd[rxq->ifr_fl_offset], M_IFLIB, M_NOWAIT | M_ZERO))) {
+		      (bus_dmamap_t *) mallocarray(scctx->isc_nrxd[rxq->ifr_fl_offset],
+		          sizeof(bus_dmamap_t), M_IFLIB, M_NOWAIT | M_ZERO))) {
 			device_printf(dev, "Unable to allocate tx_buffer map memory\n");
 			err = ENOMEM;
 			goto fail;
@@ -4745,8 +4747,8 @@
 
 /* Allocate the TX ring struct memory */
 	if (!(txq =
-	    (iflib_txq_t) malloc(sizeof(struct iflib_txq) *
-	    ntxqsets, M_IFLIB, M_NOWAIT | M_ZERO))) {
+	    (iflib_txq_t) mallocarray(ntxqsets, sizeof(struct iflib_txq),
+	        M_IFLIB, M_NOWAIT | M_ZERO))) {
 		device_printf(dev, "Unable to allocate TX ring memory\n");
 		err = ENOMEM;
 		goto fail;
@@ -4754,8 +4756,8 @@
 
 	/* Now allocate the RX */
 	if (!(rxq =
-	    (iflib_rxq_t) malloc(sizeof(struct iflib_rxq) *
-	    nrxqsets, M_IFLIB, M_NOWAIT | M_ZERO))) {
+	    (iflib_rxq_t) mallocarray(nrxqsets, sizeof(struct iflib_rxq),
+	        M_IFLIB, M_NOWAIT | M_ZERO))) {
 		device_printf(dev, "Unable to allocate RX ring memory\n");
 		err = ENOMEM;
 		goto rx_fail;
@@ -4849,7 +4851,8 @@
 		}
 		rxq->ifr_nfl = nfree_lists;
 		if (!(fl =
-			  (iflib_fl_t) malloc(sizeof(struct iflib_fl) * nfree_lists, M_IFLIB, M_NOWAIT | M_ZERO))) {
+			  (iflib_fl_t) mallocarray(nfree_lists, sizeof(struct iflib_fl),
+			      M_IFLIB, M_NOWAIT | M_ZERO))) {
 			device_printf(dev, "Unable to allocate free list memory\n");
 			err = ENOMEM;
 			goto err_tx_desc;
Index: sys/netgraph/ng_bridge.c
===================================================================
--- sys/netgraph/ng_bridge.c
+++ sys/netgraph/ng_bridge.c
@@ -907,7 +907,7 @@
 	newMask = newNumBuckets - 1;
 
 	/* Allocate and initialize new table */
-	newTab = malloc(newNumBuckets * sizeof(*newTab),
+	newTab = mallocarray(newNumBuckets, sizeof(*newTab),
 	    M_NETGRAPH_BRIDGE, M_NOWAIT | M_ZERO);
 	if (newTab == NULL)
 		return;
Index: sys/netgraph/ng_deflate.c
===================================================================
--- sys/netgraph/ng_deflate.c
+++ sys/netgraph/ng_deflate.c
@@ -427,7 +427,7 @@
 z_alloc(void *notused, u_int items, u_int size)
 {
 
-	return (malloc(items * size, M_NETGRAPH_DEFLATE, M_NOWAIT));
+	return (mallocarray(items, size, M_NETGRAPH_DEFLATE, M_NOWAIT));
 }
 
 static void
Index: sys/netgraph/ng_parse.c
===================================================================
--- sys/netgraph/ng_parse.c
+++ sys/netgraph/ng_parse.c
@@ -1207,7 +1207,8 @@
 	int align, len, blen, error = 0;
 
 	/* Initialize */
-	foff = malloc(num * sizeof(*foff), M_NETGRAPH_PARSE, M_NOWAIT | M_ZERO);
+	foff = mallocarray(num, sizeof(*foff), M_NETGRAPH_PARSE,
+	    M_NOWAIT | M_ZERO);
 	if (foff == NULL) {
 		error = ENOMEM;
 		goto done;
Index: sys/netinet6/in6_jail.c
===================================================================
--- sys/netinet6/in6_jail.c
+++ sys/netinet6/in6_jail.c
@@ -103,8 +103,8 @@
 			 */
 			used = 1;
 			if (newip6 == NULL) {
-				newip6 = malloc(ppr->pr_ip6s * sizeof(*newip6),
-				    M_PRISON, M_NOWAIT);
+				newip6 = mallocarray(ppr->pr_ip6s,
+				    sizeof(*newip6), M_PRISON, M_NOWAIT);
 				if (newip6 != NULL)
 					used = 0;
 			}
Index: sys/powerpc/pseries/phyp_vscsi.c
===================================================================
--- sys/powerpc/pseries/phyp_vscsi.c
+++ sys/powerpc/pseries/phyp_vscsi.c
@@ -336,8 +336,8 @@
 
 	mtx_lock(&sc->io_lock);
 	vscsi_setup_bus(sc);
-	sc->xfer = malloc(sizeof(sc->xfer[0])*sc->max_transactions, M_VSCSI,
-	    M_NOWAIT);
+	sc->xfer = mallocarray(sc->max_transactions, sizeof(sc->xfer[0]),
+	    M_VSCSI, M_NOWAIT);
 	for (i = 0; i < sc->max_transactions; i++) {
 		xp = &sc->xfer[i];
 		xp->sc = sc;
Index: sys/x86/cpufreq/est.c
===================================================================
--- sys/x86/cpufreq/est.c
+++ sys/x86/cpufreq/est.c
@@ -1119,7 +1119,7 @@
 		goto out;
 
 	/* Parse settings into our local table format. */
-	table = malloc((count + 1) * sizeof(freq_info), M_DEVBUF, M_NOWAIT);
+	table = mallocarray(count + 1, sizeof(freq_info), M_DEVBUF, M_NOWAIT);
 	if (table == NULL) {
 		error = ENOMEM;
 		goto out;