Index: sys/netinet/ip_icmp.c
===================================================================
--- sys/netinet/ip_icmp.c
+++ sys/netinet/ip_icmp.c
@@ -89,6 +89,12 @@
 	&VNET_NAME(icmplim), 0,
 	"Maximum number of ICMP responses per second");
 
+VNET_DEFINE_STATIC(int, icmplim_inc) = 3;
+#define	V_icmplim_inc			VNET(icmplim_inc)
+SYSCTL_INT(_net_inet_icmp, ICMPCTL_ICMPLIM, icmplim_inc, CTLFLAG_VNET | CTLFLAG_RW,
+	&VNET_NAME(icmplim_inc), 0,
+	"Increment value for randomizing the number of ICMP responses per second");
+
 VNET_DEFINE_STATIC(int, icmplim_output) = 1;
 #define	V_icmplim_output		VNET(icmplim_output)
 SYSCTL_INT(_net_inet_icmp, OID_AUTO, icmplim_output, CTLFLAG_VNET | CTLFLAG_RW,
@@ -1094,6 +1100,11 @@
 };
 #define	V_icmp_rates	VNET(icmp_rates)
 
+/*
+ * Adjust limit +/- to jitter the measurement for security.
+ * CVE-2020-25705
+ */
+
 static void
 icmp_bandlimit_init(void)
 {
@@ -1128,8 +1139,20 @@
 	    ("%s: which %d", __func__, which));
 
 	pps = counter_ratecheck(&V_icmp_rates[which].cr, V_icmplim);
-	if (pps == -1)
+
+	if (pps == -1) {
+		/*
+		 * Add random jitter to the administratively set limit.
+		 */
+		if (V_icmplim_inc > 0) {
+			int32_t inc = arc4random_uniform(V_icmplim_inc);
+			if (inc % 2)
+				V_icmplim -= inc;
+			else
+				V_icmplim += inc;
+		}
 		return (-1);
+	}
 	if (pps > 0 && V_icmplim_output)
 		log(LOG_NOTICE, "Limiting %s from %jd to %d packets/sec\n",
 			V_icmp_rates[which].descr, (intmax_t )pps, V_icmplim);