Index: head/etc/rc.d/jail
===================================================================
--- head/etc/rc.d/jail
+++ head/etc/rc.d/jail
@@ -316,7 +316,7 @@
 
 	# Extract the prefix/netmask/prefixlen part by cutting off the address.
 	_mask=${_r}
-	_mask=`expr "${_mask}" : "${_addr}\(.*\)"`
+	_mask=`expr -- "${_mask}" : "${_addr}\(.*\)"`
 
 	# Identify type {inet,inet6}.
 	case "${_addr}" in
@@ -366,8 +366,8 @@
 	while [ ${#_x} -gt 0 ]; do
 		case "${_x}" in
 		*,*)	# Extract the first argument and strip it off the list.
-			_i=`expr "${_x}" : '^\([^,]*\)'`
-			_x=`expr "${_x}" : "^[^,]*,\(.*\)"`
+			_i=`expr -- "${_x}" : '^\([^,]*\)'`
+			_x=`expr -- "${_x}" : "^[^,]*,\(.*\)"`
 		;;
 		*)	_i=${_x}
 			_x=""