diff --git a/sys/dev/kbd/kbd.c b/sys/dev/kbd/kbd.c
index 851f6771f8b4..57df93445708 100644
--- a/sys/dev/kbd/kbd.c
+++ b/sys/dev/kbd/kbd.c
@@ -837,13 +837,14 @@ static int fkey_change_ok(fkeytab_t *, fkeyarg_t *, struct thread *);
 int
 genkbd_commonioctl(keyboard_t *kbd, u_long cmd, caddr_t arg)
 {
+#ifndef KBD_DISABLE_KEYMAP_LOAD
+	keymap_t *mapp;
+#endif
 	keyarg_t *keyp;
 	fkeyarg_t *fkeyp;
 	int s;
 	int i;
-#ifndef KBD_DISABLE_KEYMAP_LOAD
 	int error;
-#endif
 
 	s = spltty();
 	switch (cmd) {
@@ -869,18 +870,29 @@ genkbd_commonioctl(keyboard_t *kbd, u_long cmd, caddr_t arg)
 		break;
 
 	case GIO_KEYMAP:	/* get keyboard translation table */
-		bcopy(kbd->kb_keymap, arg, sizeof(*kbd->kb_keymap));
-		break;
+		error = copyout(kbd->kb_keymap, *(void **)arg,
+		    sizeof(keymap_t));
+		splx(s);
+		return (error);
 	case PIO_KEYMAP:	/* set keyboard translation table */
 #ifndef KBD_DISABLE_KEYMAP_LOAD
-		error = keymap_change_ok(kbd->kb_keymap, (keymap_t *)arg,
-		    curthread);
+		mapp = malloc(sizeof *mapp, M_TEMP, M_NOWAIT);
+		error = copyin(*(void **)arg, mapp, sizeof *mapp);
 		if (error != 0) {
 			splx(s);
+			free(mapp, M_TEMP);
+			return (error);
+		}
+
+		error = keymap_change_ok(kbd->kb_keymap, mapp, curthread);
+		if (error != 0) {
+			splx(s);
+			free(mapp, M_TEMP);
 			return (error);
 		}
 		bzero(kbd->kb_accentmap, sizeof(*kbd->kb_accentmap));
-		bcopy(arg, kbd->kb_keymap, sizeof(*kbd->kb_keymap));
+		bcopy(mapp, kbd->kb_keymap, sizeof(*kbd->kb_keymap));
+		free(mapp, M_TEMP);
 		break;
 #else
 		splx(s);
diff --git a/sys/sys/kbio.h b/sys/sys/kbio.h
index 6f82c6d59017..22b028572fd6 100644
--- a/sys/sys/kbio.h
+++ b/sys/sys/kbio.h
@@ -106,7 +106,7 @@ typedef struct keyboard_repeat keyboard_repeat_t;
 #define	_KEYMAP_DECLARED
 
 struct keyent_t {
-	u_char		map[NUM_STATES];
+	u_int		map[NUM_STATES];
 	u_char		spcl;
 	u_char		flgs;
 #define	FLAG_LOCK_O	0
@@ -220,8 +220,9 @@ typedef struct fkeyarg	fkeyarg_t;
 #define GIO_SCRNMAP	_IOR('k', 2, scrmap_t)
 #define PIO_SCRNMAP	_IOW('k', 3, scrmap_t)
 #endif
-#define GIO_KEYMAP 	_IOR('k', 6, keymap_t)
-#define PIO_KEYMAP 	_IOW('k', 7, keymap_t)
+/* XXX: Should have keymap_t as an argument, but that's too big for ioctl()! */
+#define GIO_KEYMAP 	 _IO('k', 6)
+#define PIO_KEYMAP 	 _IO('k', 7)
 #define GIO_DEADKEYMAP 	_IOR('k', 8, accentmap_t)
 #define PIO_DEADKEYMAP 	_IOW('k', 9, accentmap_t)
 #define GIO_KEYMAPENT 	_IOWR('k', 10, keyarg_t)
diff --git a/usr.sbin/kbdcontrol/kbdcontrol.c b/usr.sbin/kbdcontrol/kbdcontrol.c
index bbeb75871e0f..5d20b163730e 100644
--- a/usr.sbin/kbdcontrol/kbdcontrol.c
+++ b/usr.sbin/kbdcontrol/kbdcontrol.c
@@ -256,7 +256,7 @@ get_entry(void)
 	case TLET:
 		return (unsigned char)letter;
 	case TNUM:
-		if (number < 0 || number > 255)
+		if (number < 0x000000 || number > 0x10FFFF)
 			return -1;
 		return number;
 	default:
diff --git a/usr.sbin/kbdcontrol/kbdmap.5 b/usr.sbin/kbdcontrol/kbdmap.5
index 2b94b356581f..4c4cd8696982 100644
--- a/usr.sbin/kbdcontrol/kbdmap.5
+++ b/usr.sbin/kbdcontrol/kbdmap.5
@@ -84,7 +84,7 @@ The symbol the key should produce,
 in single quotes.
 .It Ar decnum
 The
-.Tn ASCII
+.Tn Unicode
 value to produce
 as a decimal number
 (see
@@ -92,7 +92,7 @@ as a decimal number
 For example, 32 for space.
 .It 0x Ns Ar hexnum
 The
-.Tn ASCII
+.Tn Unicode
 value to produce
 as a hexadecimal number.
 For example, 0x20 for space.
@@ -274,7 +274,7 @@ This is followed
 by the symbol for the accent,
 given in single quotes or
 as a decimal or hexadecimal
-.Tn ASCII
+.Tn Unicode
 value.
 This symbol will be produced
 if the accent key is pressed and
@@ -290,7 +290,7 @@ Both symbols in a pair can be given
 in either single quotes or
 as decimal or
 hexadecimal
-.Tn ASCII
+.Tn Unicode
 values.
 .Pp
 For example,