Index: sys/kern/vfs_subr.c
===================================================================
--- sys/kern/vfs_subr.c
+++ sys/kern/vfs_subr.c
@@ -354,12 +354,12 @@
 	if (req->newlen > PATH_MAX)
 		return (E2BIG);
 
-	buf = malloc(PATH_MAX + 1, M_TEMP, M_WAITOK);
+	buf = malloc(PATH_MAX, M_TEMP, M_WAITOK);
 	error = SYSCTL_IN(req, buf, req->newlen);
 	if (error != 0)
 		goto out;
 
-	buf[req->newlen] = '\0';
+	buf[min(req->newlen, PATH_MAX - 1)] = '\0';
 
 	ndflags = LOCKLEAF | NOFOLLOW | AUDITVNODE1 | NOCACHE | SAVENAME;
 	NDINIT(&nd, LOOKUP, ndflags, UIO_SYSSPACE, buf, curthread);