untrusted comment: signature from openbsd 5.9 base secret key
RWQJVNompF3pwYa4tzI4bSrxrywOVRNvU/IRnMfm6wb0LNoTFJeyeZOe45Rj6x7kOPs4jMtFRuCzaT4wPqDKUSXPaDbrEv2tqAM=

OpenBSD 5.9 errata 20, Jul 14, 2016:

Unchecked parameters and integer overflows in the amap allocation routines
could cause malloc(9) to either not allocate enough memory, leading to memory
corruption, or to trigger a "malloc: allocation too large" panic.

Apply by doing:
    signify -Vep /etc/signify/openbsd-59-base.pub -x 020_amap.patch.sig \
	-m - | (cd /usr/src && patch -p0)

And then rebuild and install a kernel:
    cd /usr/src/sys/arch/`machine`/conf
    KK=`sysctl -n kern.osversion | cut -d# -f1`
    config $KK
    cd ../compile/$KK
    make
    make install

Index: sys/arch/amd64/amd64/vmm.c
===================================================================
RCS file: /cvs/src/sys/arch/amd64/amd64/vmm.c,v
retrieving revision 1.38
diff -u -p -r1.38 vmm.c
--- sys/arch/amd64/amd64/vmm.c	23 Feb 2016 17:17:31 -0000	1.38
+++ sys/arch/amd64/amd64/vmm.c	14 Jul 2016 15:21:07 -0000
@@ -1016,7 +1016,7 @@ vm_impl_init_vmx(struct vm *vm)
 	    PROT_READ | PROT_WRITE | PROT_EXEC,
 	    MAP_INHERIT_NONE,
 	    MADV_NORMAL,
-	    UVM_FLAG_FIXED | UVM_FLAG_OVERLAY));
+	    UVM_FLAG_FIXED));
 	if (ret) {
 		printf("vm_impl_init_vmx: uvm_mapanon failed (%d)\n", ret);
 		/* uvm_map_deallocate calls pmap_destroy for us */
Index: sys/uvm/uvm_amap.c
===================================================================
RCS file: /cvs/src/sys/uvm/uvm_amap.c,v
retrieving revision 1.59
diff -u -p -r1.59 uvm_amap.c
--- sys/uvm/uvm_amap.c	21 Aug 2015 16:04:35 -0000	1.59
+++ sys/uvm/uvm_amap.c	14 Jul 2016 15:21:09 -0000
@@ -35,6 +35,7 @@
 
 #include <sys/param.h>
 #include <sys/systm.h>
+#include <sys/stdint.h>
 #include <sys/malloc.h>
 #include <sys/kernel.h>
 #include <sys/pool.h>
@@ -165,15 +166,29 @@ static inline struct vm_amap *
 amap_alloc1(int slots, int padslots, int waitf)
 {
 	struct vm_amap *amap;
-	int totalslots;
+	size_t totalslots = (size_t)slots + padslots;
 
 	amap = pool_get(&uvm_amap_pool, (waitf == M_WAITOK) ? PR_WAITOK
 	    : PR_NOWAIT);
 	if (amap == NULL)
 		return(NULL);
 
-	totalslots = malloc_roundup((slots + padslots) * MALLOC_SLOT_UNIT) /
+	/*
+	 * Make sure that totalslots * MALLOC_SLOT_UNIT is within
+	 * a size_t, AND: since malloc_roundup may round its argument
+	 * to a multiple of the PAGE_SIZE, make sure that malloc_roundup
+	 * cannot wrap totalslots * MALLOC_SLOT_UNIT to zero.
+	 */
+	if (totalslots >= (trunc_page(SIZE_MAX) / MALLOC_SLOT_UNIT))
+		return (NULL);
+
+	totalslots = malloc_roundup(totalslots * MALLOC_SLOT_UNIT) /
 	    MALLOC_SLOT_UNIT;
+	if (totalslots > INT_MAX)
+		return (NULL);
+
+	KASSERT(totalslots > 0);
+
 	amap->am_ref = 1;
 	amap->am_flags = 0;
 #ifdef UVM_AMAP_PPREF
@@ -183,7 +198,7 @@ amap_alloc1(int slots, int padslots, int
 	amap->am_nslot = slots;
 	amap->am_nused = 0;
 
-	amap->am_slots = malloc(totalslots * MALLOC_SLOT_UNIT, M_UVMAMAP,
+	amap->am_slots = mallocarray(totalslots, MALLOC_SLOT_UNIT, M_UVMAMAP,
 	    waitf);
 	if (amap->am_slots == NULL)
 		goto fail1;
@@ -210,10 +225,14 @@ struct vm_amap *
 amap_alloc(vaddr_t sz, vaddr_t padsz, int waitf)
 {
 	struct vm_amap *amap;
-	int slots, padslots;
+	size_t slots, padslots;
 
 	AMAP_B2SLOT(slots, sz);		/* load slots */
 	AMAP_B2SLOT(padslots, padsz);
+
+	/* Ensure that slots + padslots <= INT_MAX */
+	if (slots > INT_MAX || padslots > INT_MAX - slots)
+		return (NULL);
 
 	amap = amap_alloc1(slots, padslots, waitf);
 	if (amap) {