3469 dbuf_read_impl shows too much enthusiasm
Reviewed by: Bryan Cantrill <bryan@joyent.com>

@@ -20,10 +20,11 @@
  */
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
  * Copyright (c) 2012 by Delphix. All rights reserved.
+ * Copyright (c) 2013, Joyent, Inc. All rights reserved.
  */
 
 #include <sys/zfs_context.h>
 #include <sys/dmu.h>
 #include <sys/dmu_impl.h>

@@ -530,12 +531,23 @@
                 ASSERT3U(bonuslen, <=, db->db.db_size);
                 db->db.db_data = zio_buf_alloc(DN_MAX_BONUSLEN);
                 arc_space_consume(DN_MAX_BONUSLEN, ARC_SPACE_OTHER);
                 if (bonuslen < DN_MAX_BONUSLEN)
                         bzero(db->db.db_data, DN_MAX_BONUSLEN);
-                if (bonuslen)
-                        bcopy(DN_BONUS(dn->dn_phys), db->db.db_data, bonuslen);
+
+                if (bonuslen) {
+                        /*
+                         * Absent byzantine on-disk corruption, we fully expect
+                         * our bonuslen to be no more than DN_MAX_BONUSLEN --
+                         * but we nonetheless explicitly clamp it on the bcopy()
+                         * to prevent any on-disk corruption from becoming
+                         * rampant in-kernel corruption.
+                         */
+                        bcopy(DN_BONUS(dn->dn_phys), db->db.db_data,
+                            MIN(bonuslen, DN_MAX_BONUSLEN));
+                }
+
                 DB_DNODE_EXIT(db);
                 dbuf_update_data(db);
                 db->db_state = DB_CACHED;
                 mutex_exit(&db->db_mtx);
                 return;