untrusted comment: verify with openbsd-78-base.pub
RWS3/nvFmk4SWWL+BKmsF2Q2PM73Jrx+jAlwu0gdDd/TYDXNo/b/kVm7BnwYx0dGHRKVwFuIkWjeLmyCa9+xz02wQI3rynKghw4=

OpenBSD 7.8 errata 053, September 14, 2026:

Prevent integer overflow in wscons(4).

Apply by doing:
    signify -Vep /etc/signify/openbsd-78-base.pub -x 053_wscons.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install a new kernel:
    KK=`sysctl -n kern.osversion | cut -d# -f1`
    cd /usr/src/sys/arch/`machine`/compile/$KK
    make obj
    make config
    make
    make install

Index: sys/dev/wscons/wsemul_sun.c
===================================================================
RCS file: /cvs/src/sys/dev/wscons/wsemul_sun.c,v
diff -u -p -u -r1.37 wsemul_sun.c
--- sys/dev/wscons/wsemul_sun.c	24 Jul 2023 17:03:32 -0000	1.37
+++ sys/dev/wscons/wsemul_sun.c	6 Sep 2026 18:02:10 -0000
@@ -95,6 +95,8 @@ const struct wsemul_ops wsemul_sun_ops =
 
 #define	SUN_EMUL_NARGS	2		/* max # of args to a command */
 
+#define	SUN_EMUL_ARG_CLAMP	100000	/* max value of arg to a command */
+
 struct wsemul_sun_emuldata {
 	const struct wsdisplay_emulops *emulops;
 	struct wsemul_abortstate abortstate;
@@ -106,7 +108,7 @@ struct wsemul_sun_emuldata {
 
 	u_int state;			/* processing state */
 	u_int flags;
-	u_int args[SUN_EMUL_NARGS];	/* command args, if CONTROL */
+	int args[SUN_EMUL_NARGS];	/* command args, if CONTROL */
 	int nargs;			/* number of args */
 
 	u_int scrolldist;		/* distance to scroll */
@@ -612,17 +614,28 @@ wsemul_sun_output_control(struct wsemul_
 			    (SUN_EMUL_NARGS - 1) * sizeof(edp->args[0]));
 			edp->args[edp->nargs = SUN_EMUL_NARGS - 1] = 0;
 		}
-		edp->args[edp->nargs] = (edp->args[edp->nargs] * 10) +
-		    (instate->inchar - '0');
+		/* Do not allow values to grow too large */
+		if (edp->args[edp->nargs] >= 0 &&
+		    edp->args[edp->nargs] < SUN_EMUL_ARG_CLAMP / 10) {
+			edp->args[edp->nargs] = (edp->args[edp->nargs] * 10) +
+			    (instate->inchar - '0');
+		} else
+			edp->args[edp->nargs] = -1;	/* clamped */
 		break;
 
 	case ';':		/* argument terminator */
+		/* apply clamp */
+		if (edp->args[edp->nargs] < 0)
+			edp->args[edp->nargs] = SUN_EMUL_ARG_CLAMP;
 		if (edp->nargs < SUN_EMUL_NARGS)
 			edp->nargs++;
 		break;
 
 	default:		/* end of escape sequence */
 		oargs = edp->nargs;
+		/* apply clamp */
+		if (edp->args[edp->nargs] < 0)
+			edp->args[edp->nargs] = SUN_EMUL_ARG_CLAMP;
 		if (edp->nargs < SUN_EMUL_NARGS)
 			edp->nargs++;
 		rc = wsemul_sun_control(edp, instate);
Index: sys/dev/wscons/wsemul_vt100.c
===================================================================
RCS file: /cvs/src/sys/dev/wscons/wsemul_vt100.c,v
diff -u -p -u -r1.48 wsemul_vt100.c
--- sys/dev/wscons/wsemul_vt100.c	5 Nov 2024 08:12:08 -0000	1.48
+++ sys/dev/wscons/wsemul_vt100.c	6 Sep 2026 18:02:10 -0000
@@ -866,14 +866,25 @@ wsemul_vt100_output_dcs(struct wsemul_vt
 		/* argument digit */
 		if (edp->nargs >= VT100_EMUL_NARGS)
 			break;
-		edp->args[edp->nargs] = (edp->args[edp->nargs] * 10) +
-		    (instate->inchar - '0');
+		/* Do not allow values to grow too large */
+		if (edp->args[edp->nargs] >= 0 &&
+		    edp->args[edp->nargs] < VT100_EMUL_ARG_CLAMP / 10) {
+			edp->args[edp->nargs] = (edp->args[edp->nargs] * 10) +
+			    (instate->inchar - '0');
+		} else
+			edp->args[edp->nargs] = -1;	/* clamped */
 		break;
 	case ';': /* argument terminator */
+		/* apply clamp */
+		if (edp->args[edp->nargs] < 0)
+			edp->args[edp->nargs] = VT100_EMUL_ARG_CLAMP;
 		if (edp->nargs < VT100_EMUL_NARGS)
 			edp->nargs++;
 		break;
 	default:
+		/* apply clamp */
+		if (edp->args[edp->nargs] < 0)
+			edp->args[edp->nargs] = VT100_EMUL_ARG_CLAMP;
 		if (edp->nargs < VT100_EMUL_NARGS)
 			edp->nargs++;
 		newstate = VT100_EMUL_STATE_STRING;
@@ -1061,12 +1072,20 @@ wsemul_vt100_output_csi(struct wsemul_vt
 	case '0': case '1': case '2': case '3': case '4':
 	case '5': case '6': case '7': case '8': case '9':
 		/* argument digit */
-		if (edp->nargs > VT100_EMUL_NARGS - 1)
+		if (edp->nargs >= VT100_EMUL_NARGS)
 			break;
-		edp->args[edp->nargs] = (edp->args[edp->nargs] * 10) +
-		    (instate->inchar - '0');
+		/* Do not allow values to grow too large */
+		if (edp->args[edp->nargs] >= 0 &&
+		    edp->args[edp->nargs] < VT100_EMUL_ARG_CLAMP / 10) {
+			edp->args[edp->nargs] = (edp->args[edp->nargs] * 10) +
+			    (instate->inchar - '0');
+		} else
+			edp->args[edp->nargs] = -1;	/* clamped */
 		break;
 	case ';': /* argument terminator */
+		/* apply clamp */
+		if (edp->args[edp->nargs] < 0)
+			edp->args[edp->nargs] = VT100_EMUL_ARG_CLAMP;
 		if (edp->nargs < VT100_EMUL_NARGS)
 			edp->nargs++;
 		break;
@@ -1082,6 +1101,9 @@ wsemul_vt100_output_csi(struct wsemul_vt
 		break;
 	default: /* end of escape sequence */
 		oargs = edp->nargs;
+		/* apply clamp */
+		if (edp->args[edp->nargs] < 0)
+			edp->args[edp->nargs] = VT100_EMUL_ARG_CLAMP;
 		if (edp->nargs < VT100_EMUL_NARGS)
 			edp->nargs++;
 		rc = wsemul_vt100_handle_csi(edp, instate, kernel);
Index: sys/dev/wscons/wsemul_vt100var.h
===================================================================
RCS file: /cvs/src/sys/dev/wscons/wsemul_vt100var.h,v
diff -u -p -u -r1.14 wsemul_vt100var.h
--- sys/dev/wscons/wsemul_vt100var.h	5 Nov 2024 08:12:08 -0000	1.14
+++ sys/dev/wscons/wsemul_vt100var.h	6 Sep 2026 18:02:10 -0000
@@ -29,6 +29,8 @@
 
 #define	VT100_EMUL_NARGS	10	/* max # of args to a command */
 
+#define	VT100_EMUL_ARG_CLAMP	100000	/* max value of arg to a command */
+
 struct wsemul_vt100_emuldata {
 	const struct wsdisplay_emulops *emulops;
 	struct wsemul_abortstate abortstate;
@@ -72,7 +74,7 @@ struct wsemul_vt100_emuldata {
 	int sschartab; /* single shift */
 
 	int nargs;
-	u_int args[VT100_EMUL_NARGS]; /* numeric command args (CSI/DCS) */
+	int args[VT100_EMUL_NARGS]; /* numeric command args (CSI/DCS) */
 
 	char modif1;	/* {>?} in VT100_EMUL_STATE_CSI */
 	char modif2;	/* {!"$&} in VT100_EMUL_STATE_CSI */