Index: kern_sendfile.c
===================================================================
--- kern_sendfile.c	(revision 297210)
+++ kern_sendfile.c	(working copy)
@@ -673,6 +673,8 @@ retry_space:
 		 * hdrlen is set to 0 after the first loop.
 		 */
 		space -= hdrlen;
+		if (space < 0)
+			space = 0;
 
 		if (vp != NULL) {
 			error = vn_lock(vp, LK_SHARED);