Index: src/sys/amd64/amd64/trap.c
===================================================================
--- src/sys/amd64/amd64/trap.c	(revision 4564)
+++ src/sys/amd64/amd64/trap.c	(revision 4565)
@@ -846,6 +846,17 @@
 	/*
 	 * Traced syscall.
 	 */
+
+	/*
+	 * If the user-supplied value of %rip is not a canonical
+	 * address, then some CPUs will trigger a ring 0 #GP during
+	 * the sysret instruction.  However, the fault handler would
+	 * execute with the user's %gs and %rsp in ring 0 which would
+	 * not be safe.  Instead, preemptively kill the thread with a
+	 * SIGBUS.
+	 */
+	if (td->td_frame->tf_rip >= VM_MAXUSER_ADDRESS)
+		trapsignal(td, SIGBUS, T_PROTFLT);
 	if (orig_tf_rflags & PSL_T) {
 		frame.tf_rflags &= ~PSL_T;
 		trapsignal(td, SIGTRAP, 0);