Index: kern/kern_uidinfo.c
===================================================================
RCS file: /cvsroot/src/sys/kern/kern_uidinfo.c,v
retrieving revision 1.10
diff -u -p -u -r1.10 kern_uidinfo.c
--- kern/kern_uidinfo.c	18 Mar 2017 05:49:56 -0000	1.10
+++ kern/kern_uidinfo.c	1 Mar 2019 02:43:19 -0000
@@ -63,6 +63,7 @@ sysctl_kern_uidinfo_cnt(SYSCTLFN_ARGS)
 		_MEM(proccnt),
 		_MEM(lwpcnt),
 		_MEM(lockcnt),
+		_MEM(semcnt),
 		_MEM(sbsize),
 #undef _MEM
 	};
@@ -119,6 +120,12 @@ sysctl_kern_uidinfo_setup(void)
 		       CTL_CREATE, CTL_EOL);
 	sysctl_createv(&kern_uidinfo_sysctllog, 0, &rnode, &cnode,
 		       CTLFLAG_PERMANENT,
+		       CTLTYPE_QUAD, "semcnt",
+		       SYSCTL_DESCR("Number of semaphores used for the current user"),
+		       sysctl_kern_uidinfo_cnt, 0, NULL, 0,
+		       CTL_CREATE, CTL_EOL);
+	sysctl_createv(&kern_uidinfo_sysctllog, 0, &rnode, &cnode,
+		       CTLFLAG_PERMANENT,
 		       CTLTYPE_QUAD, "sbsize",
 		       SYSCTL_DESCR("Socket buffers used for the current user"),
 		       sysctl_kern_uidinfo_cnt, 0, NULL, 0,
@@ -219,6 +226,22 @@ chglwpcnt(uid_t uid, int diff)
 	return lwpcnt;
 }
 
+/*
+ * Change the count associated with number of semaphores
+ * a given user is using.
+ */
+int
+chgsemcnt(uid_t uid, int diff)
+{
+	struct uidinfo *uip;
+	long semcnt;
+
+	uip = uid_find(uid);
+	semcnt = atomic_add_long_nv(&uip->ui_semcnt, diff);
+	KASSERT(semcnt >= 0);
+	return semcnt;
+}
+
 int
 chgsbsize(struct uidinfo *uip, u_long *hiwat, u_long to, rlim_t xmax)
 {
Index: kern/uipc_sem.c
===================================================================
RCS file: /cvsroot/src/sys/kern/uipc_sem.c,v
retrieving revision 1.54
diff -u -p -u -r1.54 uipc_sem.c
--- kern/uipc_sem.c	21 Feb 2019 21:49:23 -0000	1.54
+++ kern/uipc_sem.c	1 Mar 2019 02:43:19 -0000
@@ -85,6 +85,7 @@ __KERNEL_RCSID(0, "$NetBSD: uipc_sem.c,v
 #include <sys/syscallargs.h>
 #include <sys/syscallvar.h>
 #include <sys/sysctl.h>
+#include <sys/uidinfo.h>
 #include <sys/cprng.h>
 
 MODULE(MODULE_CLASS_MISC, ksem, NULL);
@@ -467,8 +468,10 @@ ksem_create(lwp_t *l, const char *name, 
 		len = 0;
 	}
 
-	if (atomic_inc_uint_nv(&l->l_proc->p_nsems) > SEM_NSEMS_MAX) {
-		atomic_dec_uint(&l->l_proc->p_nsems);
+	u_int cnt;
+	uid_t uid = kauth_cred_getuid(l->l_cred);
+	if ((cnt = chgsemcnt(uid, 1)) > SEM_NSEMS_MAX) {
+		chgsemcnt(uid, -1);
 		if (kname != NULL)
 			kmem_free(kname, len);
 		return ENOSPC;
@@ -511,7 +514,7 @@ ksem_free(ksem_t *ks)
 	kmem_free(ks, sizeof(ksem_t));
 
 	atomic_dec_uint(&nsems_total);
- 	atomic_dec_uint(&curproc->p_nsems);	
+	chgsemcnt(kauth_cred_getuid(curproc->p_cred), -1);
 }
 
 #define	KSEM_ID_IS_PSHARED(id)		\
Index: sys/param.h
===================================================================
RCS file: /cvsroot/src/sys/sys/param.h,v
retrieving revision 1.582
diff -u -p -u -r1.582 param.h
--- sys/param.h	3 Feb 2019 08:02:25 -0000	1.582
+++ sys/param.h	1 Mar 2019 02:43:19 -0000
@@ -67,7 +67,7 @@
  *	2.99.9		(299000900)
  */
 
-#define	__NetBSD_Version__	899003400	/* NetBSD 8.99.34 */
+#define	__NetBSD_Version__	899003500	/* NetBSD 8.99.35 */
 
 #define __NetBSD_Prereq__(M,m,p) (((((M) * 100000000) + \
     (m) * 1000000) + (p) * 100) <= __NetBSD_Version__)
Index: sys/proc.h
===================================================================
RCS file: /cvsroot/src/sys/sys/proc.h,v
retrieving revision 1.350
diff -u -p -u -r1.350 proc.h
--- sys/proc.h	5 Dec 2018 18:16:51 -0000	1.350
+++ sys/proc.h	1 Mar 2019 02:43:19 -0000
@@ -316,7 +316,6 @@ struct proc {
 	pid_t 		p_vfpid_done;	/* :: vforked done pid */
 	lwpid_t		p_lwp_created;	/* :: lwp created */
 	lwpid_t		p_lwp_exited;	/* :: lwp exited */
-	u_int		p_nsems;	/* Count of semaphores */
 	char		*p_path;	/* :: full pathname of executable */
 
 /*
@@ -338,7 +337,6 @@ struct proc {
 
 	vaddr_t		p_psstrp;	/* :: address of process's ps_strings */
 	u_int		p_pax;		/* :: PAX flags */
-
 	int		p_xexit;	/* p: exit code */
 /*
  * End area that is copied on creation
Index: sys/uidinfo.h
===================================================================
RCS file: /cvsroot/src/sys/sys/uidinfo.h,v
retrieving revision 1.3
diff -u -p -u -r1.3 uidinfo.h
--- sys/uidinfo.h	9 Jun 2012 02:31:15 -0000	1.3
+++ sys/uidinfo.h	1 Mar 2019 02:43:19 -0000
@@ -45,11 +45,13 @@ struct uidinfo {
 	u_long	ui_proccnt;	/* Number of processes */
 	u_long	ui_lwpcnt;	/* Number of lwps */
 	u_long	ui_lockcnt;	/* Number of locks */
+	u_long	ui_semcnt;	/* Number of semaphores */
 	u_long	ui_sbsize;	/* Socket buffer size */
 };
 
 int	chgproccnt(uid_t, int);
 int	chglwpcnt(uid_t, int);
+int	chgsemcnt(uid_t, int);
 int	chgsbsize(struct uidinfo *, u_long *, u_long, rlim_t);
 struct uidinfo *uid_find(uid_t);
 void	uid_init(void);