diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c
--- a/sys/kern/vfs_syscalls.c
+++ b/sys/kern/vfs_syscalls.c
@@ -5075,6 +5075,15 @@
 	if (len == 0)
 		goto out;
 
+	/*
+	 * Make sure that the ranges we check and lock below are valid.
+	 */
+	if (inoff < 0 || outoff < 0 || inoff + (ssize_t)len < 0 ||
+	    outoff + (ssize_t)len < 0) {
+		error = EINVAL;
+		goto out;
+	}
+
 	/*
 	 * If infp and outfp refer to the same file, the byte ranges cannot
 	 * overlap.