diff --git a/src/lib.rs b/src/lib.rs
index fcf4dc72e9..e0b097d8c0 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -40,7 +40,12 @@ pub mod error {
         pub fn demux(res: usize) -> Result<usize, Self> {
             if res > usize::wrapping_neg(4096) {
                 Err(Self {
-                    errno: res.wrapping_neg().try_into().expect("2^BITS - res < 4096"),
+                    // Saturate to u16::MAX on overflow rather than panic; the
+                    // demux ABI returns the errno in the low 16 bits of a usize,
+                    // and `wrapping_neg(4096)` is the boundary. Values above
+                    // u16::MAX indicate a kernel ABI violation; surfacing
+                    // u16::MAX is safer than panicking every syscall wrapper.
+                    errno: res.wrapping_neg().try_into().unwrap_or(u16::MAX),
                 })
             } else {
                 Ok(res)