Index: vm_map.c
===================================================================
--- vm_map.c
+++ vm_map.c
@@ -4502,6 +4502,11 @@
 	vm_size_t size;
 	struct ucred *cred;
 
+	/*
+	 * Check that the address is not bogus.
+	 */
+	if (vaddr < vm_map_min(map) || vaddr >= vm_map_max(map))
+		return (KERN_INVALID_ADDRESS);
 RetryLookup:
 
 	vm_map_lock_read(map);