diff --git a/minix/kernel/system/do_safecopy.c b/minix/kernel/system/do_safecopy.c
index eac8c0ebd..a76be4688 100644
--- a/minix/kernel/system/do_safecopy.c
+++ b/minix/kernel/system/do_safecopy.c
@@ -412,7 +412,7 @@ int do_vsafecopy(struct proc * caller, message * m_ptr)
 
 	/* No. of vector elements. */
 	els = m_ptr->m_lsys_kern_vsafecopy.vec_size;
-	if (els > SCPVEC_NR) {
+	if (els < 0 || els > SCPVEC_NR) {
 		return EINVAL;
 	}
 	bytes = els * sizeof(struct vscp_vec);