untrusted comment: signature from openbsd 5.9 base secret key
RWQJVNompF3pwQJgnjrPLUEn2gin3oCINiHeB9FZ7fNH6yEvWa+w8tU7NuyO+o32aHbFiOOSaZtQrFplCRb33+LtdDNgOYBG2wI=

OpenBSD 5.9 errata 26, Sep 17, 2016:

Limit the number of wscons fonts that can be loaded into the kernel.

Apply by doing:
    signify -Vep /etc/signify/openbsd-59-base.pub -x 026_wsfont.patch.sig \
	-m - | (cd /usr/src && patch -p0)

And then rebuild and install a kernel:
    cd /usr/src/sys/arch/`machine`/conf
    KK=`sysctl -n kern.osversion | cut -d# -f1`
    config $KK
    cd ../compile/$KK
    make
    make install

Index: sys/dev/wscons/wsconsio.h
===================================================================
RCS file: /cvs/src/sys/dev/wscons/wsconsio.h,v
retrieving revision 1.73
retrieving revision 1.73.2.1
diff -u -p -r1.73 -r1.73.2.1
--- sys/dev/wscons/wsconsio.h	12 Dec 2015 12:30:18 -0000	1.73
+++ sys/dev/wscons/wsconsio.h	16 Sep 2016 15:01:05 -0000	1.73.2.1
@@ -404,6 +404,7 @@ struct wsdisplay_cursor {
 struct wsdisplay_font {
 	char name[WSFONT_NAME_SIZE];
 	int index;
+#define WSDISPLAY_MAXFONTCOUNT	8
 	int firstchar, numchars;
 	int encoding;
 #define WSDISPLAY_FONTENC_ISO 0
Index: sys/dev/wsfont/wsfont.c
===================================================================
RCS file: /cvs/src/sys/dev/wsfont/wsfont.c,v
retrieving revision 1.42
retrieving revision 1.42.2.1
diff -u -p -r1.42 -r1.42.2.1
--- sys/dev/wsfont/wsfont.c	13 Sep 2015 16:44:30 -0000	1.42
+++ sys/dev/wsfont/wsfont.c	16 Sep 2016 15:01:05 -0000	1.42.2.1
@@ -450,13 +450,21 @@ wsfont_add(struct wsdisplay_font *font, 
 {
 	static int cookiegen = 666;
 	struct font *ent;
-	int s;
+	int s, fontc = 0;
 
 	s = splhigh();
 
 	/* Don't allow exact duplicates */
 	if (wsfont_find(font->name, font->fontwidth, font->fontheight,
 	    font->stride) >= 0) {
+		splx(s);
+		return (-1);
+	}
+
+	TAILQ_FOREACH(ent, &fontlist, chain)
+		fontc++;
+
+	if (fontc >= WSDISPLAY_MAXFONTCOUNT) {
 		splx(s);
 		return (-1);
 	}