diff --git a/sys/amd64/vmm/io/ppt.c b/sys/amd64/vmm/io/ppt.c
index fdf136ba368c..d3ec8d17d926 100644
--- a/sys/amd64/vmm/io/ppt.c
+++ b/sys/amd64/vmm/io/ppt.c
@@ -89,7 +89,7 @@ static struct pptdev {
 		void **cookie;
 		struct pptintr_arg *arg;
 	} msix;
-} pptdevs[32];
+} pptdevs[64];
 
 static int num_pptdevs;
 
diff --git a/sys/amd64/vmm/vmm.c b/sys/amd64/vmm/vmm.c
index d0e64276b4c5..82d4baa35e09 100644
--- a/sys/amd64/vmm/vmm.c
+++ b/sys/amd64/vmm/vmm.c
@@ -862,30 +862,42 @@ vm_lapic(struct vm *vm, int cpu)
 boolean_t
 vmm_is_pptdev(int bus, int slot, int func)
 {
-	int found, b, s, f, n;
+	int found, i, n;
+	int b, s, f;
 	char *val, *cp, *cp2;
 
 	/*
-	 * setenv pptdevs "1/2/3 4/5/6 7/8/9 10/11/12"
+	 * XXX
+	 * The length of an environment variable is limited to 128 bytes which
+	 * puts an upper limit on the number of passthru devices that may be
+	 * specified using a single environment variable.
+	 *
+	 * Work around this by scanning multiple environment variable
+	 * names instead of a single one - yuck!
 	 */
+	const char *names[] = { "pptdevs", "pptdevs2", "pptdevs3", NULL };
+
+	/* set pptdevs="1/2/3 4/5/6 7/8/9 10/11/12" */
 	found = 0;
-	cp = val = getenv("pptdevs");
-	while (cp != NULL && *cp != '\0') {
-		if ((cp2 = strchr(cp, ' ')) != NULL)
-			*cp2 = '\0';
+	for (i = 0; names[i] != NULL && !found; i++) {
+		cp = val = getenv(names[i]);
+		while (cp != NULL && *cp != '\0') {
+			if ((cp2 = strchr(cp, ' ')) != NULL)
+				*cp2 = '\0';
 
-		n = sscanf(cp, "%d/%d/%d", &b, &s, &f);
-		if (n == 3 && bus == b && slot == s && func == f) {
-			found = 1;
-			break;
-		}
+			n = sscanf(cp, "%d/%d/%d", &b, &s, &f);
+			if (n == 3 && bus == b && slot == s && func == f) {
+				found = 1;
+				break;
+			}
 		
-		if (cp2 != NULL)
-			*cp2++ = ' ';
+			if (cp2 != NULL)
+				*cp2++ = ' ';
 
-		cp = cp2;
+			cp = cp2;
+		}
+		freeenv(val);
 	}
-	freeenv(val);
 	return (found);
 }