Index: process_machdep.c
===================================================================
RCS file: /cvsroot/src/sys/arch/amd64/amd64/process_machdep.c,v
retrieving revision 1.43
diff -u -r1.43 process_machdep.c
--- process_machdep.c	24 Jul 2019 16:36:47 -0000	1.43
+++ process_machdep.c	6 Aug 2019 01:15:00 -0000
@@ -327,14 +327,19 @@
 		if (!process_machdep_validxstate(lt->l_proc))
 			return EINVAL;
 		if (__predict_false(l->l_proc->p_flag & PK_32)) {
-			struct netbsd32_iovec *user_iov = addr;
-			iov.iov_base = NETBSD32PTR64(user_iov->iov_base);
-			iov.iov_len = user_iov->iov_len;
+			struct netbsd32_iovec user_iov;
+			if ((error = copyin(addr, &user_iov, sizeof(user_iov))) != 0)
+				return error;
+
+			iov.iov_base = NETBSD32PTR64(user_iov.iov_base);
+			iov.iov_len = user_iov.iov_len;
 		} else {
-			struct iovec *user_iov;
-			user_iov = (struct iovec*)addr;
-			iov.iov_base = user_iov->iov_base;
-			iov.iov_len = user_iov->iov_len;
+			struct iovec user_iov;
+			if ((error = copyin(addr, &user_iov, sizeof(user_iov))) != 0)
+				return error;
+
+			iov.iov_base = user_iov.iov_base;
+			iov.iov_len = user_iov.iov_len;
 		}
 
 		error = proc_vmspace_getref(l->l_proc, &vm);