untrusted comment: verify with openbsd-62-base.pub
RWRVWzAMgtyg7l5ZGCJBAbSiJfEEzMq3kY1fOgLnDQLF1KtEQWJk2Hai+/9Yi+z9QWhnZ8htj8QT1a5QFMiSctASBt55FWvKsgE=

OpenBSD 6.2 errata 022, August 24, 2018:

State from the FPU of one user land process could be exposed to
other processes.

Apply by doing:
    signify -Vep /etc/signify/openbsd-62-base.pub -x 022_fpufork.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install a new kernel:
    KK=`sysctl -n kern.osversion | cut -d# -f1`
    cd /usr/src/sys/arch/`machine`/compile/$KK
    make obj
    make config
    make
    make install

Index: sys/arch/amd64/amd64/vm_machdep.c
===================================================================
RCS file: /cvs/src/sys/arch/amd64/amd64/vm_machdep.c,v
retrieving revision 1.40.2.1
diff -u -p -r1.40.2.1 vm_machdep.c
--- sys/arch/amd64/amd64/vm_machdep.c	22 Jun 2018 13:05:33 -0000	1.40.2.1
+++ sys/arch/amd64/amd64/vm_machdep.c	21 Aug 2018 19:43:42 -0000
@@ -72,13 +72,15 @@ void
 cpu_fork(struct proc *p1, struct proc *p2, void *stack, void *tcb,
     void (*func)(void *), void *arg)
 {
+	struct cpu_info *ci = curcpu();
 	struct pcb *pcb = &p2->p_addr->u_pcb;
 	struct pcb *pcb1 = &p1->p_addr->u_pcb;
 	struct trapframe *tf;
 	struct switchframe *sf;
 
 	/* Save the fpu h/w state to p1's pcb so that we can copy it. */
-	fpusave(&pcb1->pcb_savefpu);
+	if (p1 != &proc0 && (ci->ci_flags & CPUF_USERXSTATE))
+		fpusave(&pcb1->pcb_savefpu);
 
 	p2->p_md.md_flags = p1->p_md.md_flags;