Index: sys/security/audit/audit_pipe.c =================================================================== --- sys/security/audit/audit_pipe.c +++ sys/security/audit/audit_pipe.c @@ -756,7 +756,7 @@ case AUDITPIPE_SET_QLIMIT: /* Lockless integer write. */ - if (*(u_int *)data >= AUDIT_PIPE_QLIMIT_MIN || + if (*(u_int *)data >= AUDIT_PIPE_QLIMIT_MIN && *(u_int *)data <= AUDIT_PIPE_QLIMIT_MAX) { ap->ap_qlimit = *(u_int *)data; error = 0;