--- a/usr/src/uts/common/fs/zfs/zfs_ioctl.c	Fri Sep 21 12:05:37 2007 -0700
+++ b/usr/src/uts/common/fs/zfs/zfs_ioctl.c	Fri Sep 21 14:52:33 2007 -0700
@@ -861,6 +861,11 @@
 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
 		return (error);
 
+	if (zc->zc_cookie < spa_version(spa) || zc->zc_cookie > SPA_VERSION) {
+		spa_close(spa, FTAG);
+		return (EINVAL);
+	}
+
 	spa_upgrade(spa, zc->zc_cookie);
 	spa_close(spa, FTAG);