diff --git a/kdc/connect.c b/kdc/connect.c
index 1f44aec1f..39b7132a1 100644
--- a/kdc/connect.c
+++ b/kdc/connect.c
@@ -530,6 +530,12 @@ add_new_tcp (struct descr *d, int parent, int child)
 	return;
     }
 	    
+    if (s >= FD_SETSIZE) {
+	krb5_warnx(context, "socket FD too large");
+	close (s);
+	return;
+    }
+
     d[child].s = s;
     d[child].timeout = time(NULL) + TCP_TIMEOUT;
     d[child].type = SOCK_STREAM;