--- lib/libcasper/services/cap_net/cap_net.c.orig
+++ lib/libcasper/services/cap_net/cap_net.c
@@ -1122,12 +1122,37 @@
 	return (0);
 }
 
+/*
+ * If the old sublimit restricted a subkey, the new one must too;
+ * a missing subkey means "allow any" at request time.
+ */
+static bool
+verify_subkeys_present(const nvlist_t *oldfunclimits,
+    const nvlist_t *newfunclimit)
+{
+	void *cookie;
+	const char *name;
+
+	if (oldfunclimits == NULL)
+		return (true);
+
+	cookie = NULL;
+	while ((name = nvlist_next(oldfunclimits, NULL, &cookie)) != NULL) {
+		if (!nvlist_exists(newfunclimit, name))
+			return (false);
+	}
+	return (true);
+}
+
 static bool
 verify_only_sa_newlimts(const nvlist_t *oldfunclimits,
     const nvlist_t *newfunclimit)
 {
 	void *cookie;
 
+	if (!verify_subkeys_present(oldfunclimits, newfunclimit))
+		return (false);
+
 	cookie = NULL;
 	while (nvlist_next(newfunclimit, NULL, &cookie) != NULL) {
 		void *sacookie;
@@ -1200,6 +1225,9 @@
 		    LIMIT_NV_ADDR2NAME, NULL);
 	}
 
+	if (!verify_subkeys_present(oldfunclimits, newfunclimit))
+		return (false);
+
 	cookie = NULL;
 	while (nvlist_next(newfunclimit, NULL, &cookie) != NULL) {
 		if (strcmp(cnvlist_name(cookie), "sockaddr") == 0) {
@@ -1258,6 +1286,9 @@
 		    LIMIT_NV_NAME2ADDR, NULL);
 	}
 
+	if (!verify_subkeys_present(oldfunclimits, newfunclimit))
+		return (false);
+
 	cookie = NULL;
 	while (nvlist_next(newfunclimit, NULL, &cookie) != NULL) {
 		if (strcmp(cnvlist_name(cookie), "hosts") == 0) {