diff --git a/gnu/local.mk b/gnu/local.mk
index c6f09df54d..b6b6259438 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1078,6 +1078,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/mozjs38-tracelogger.patch		\
   %D%/packages/patches/mozjs38-version-detection.patch		\
   %D%/packages/patches/mrrescue-support-love-11.patch		\
+  %D%/packages/patches/mtools-mformat-uninitialized.patch	\
   %D%/packages/patches/mumble-1.2.19-abs.patch			\
   %D%/packages/patches/mumps-build-parallelism.patch		\
   %D%/packages/patches/mupen64plus-ui-console-notice.patch	\
diff --git a/gnu/packages/mtools.scm b/gnu/packages/mtools.scm
index 5be3da0137..b93d5789b9 100644
--- a/gnu/packages/mtools.scm
+++ b/gnu/packages/mtools.scm
@@ -1,6 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2013 John Darrington <jmd@gnu.org>
-;;; Copyright © 2015 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2015, 2019 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2018 Efraim Flashner <efraim@flashner.co.il>
 ;;;
@@ -23,20 +23,22 @@
   #:use-module (guix licenses)
   #:use-module (guix packages)
   #:use-module (guix download)
-  #:use-module (guix build-system gnu))
+  #:use-module (guix build-system gnu)
+  #:use-module (gnu packages))
 
 (define-public mtools
   (package
     (name "mtools")
     (version "4.0.23")
-    (source
-     (origin
-      (method url-fetch)
-      (uri (string-append "mirror://gnu/mtools/mtools-"
-                          version ".tar.bz2"))
-      (sha256
-       (base32
-        "1qwfxzr964fasxlzhllahk8mzh7c82s808wvly95dsqsflkdp27i"))))
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "mirror://gnu/mtools/mtools-"
+                                  version ".tar.bz2"))
+              (sha256
+               (base32
+                "1qwfxzr964fasxlzhllahk8mzh7c82s808wvly95dsqsflkdp27i"))
+              (patches
+               (search-patches "mtools-mformat-uninitialized.patch"))))
     (build-system gnu-build-system)
     (home-page "https://www.gnu.org/software/mtools/")
     (synopsis "Access MS-DOS disks without mounting")
diff --git a/gnu/packages/patches/mtools-mformat-uninitialized.patch b/gnu/packages/patches/mtools-mformat-uninitialized.patch
new file mode 100644
index 0000000000..ae69d45c99
--- /dev/null
+++ b/gnu/packages/patches/mtools-mformat-uninitialized.patch
@@ -0,0 +1,20 @@
+Fix a bug whereby 'mformat' could end up passing uninitialized bytes
+to write(2).  This could be reproduced with:
+
+  mformat -C -f 1440 -L 16  -N 77777777 -i  /tmp/x ::
+
+where the output of /tmp/x would be non-deterministic.
+
+Patch by Ludovic Courtès <ludo@gnu.org>.
+
+--- mtools-4.0.23/mformat.c	2019-04-21 00:12:01.496116195 +0200
++++ mtools-4.0.23/mformat.c	2019-04-21 00:12:36.675967157 +0200
+@@ -927,6 +927,7 @@ void mformat(int argc, char **argv, int
+ 	
+ 	char *endptr;
+ 
++	memset(&boot.bytes, '\0', sizeof boot);
+ 	hs = hs_set = 0;
+ 	argtracks = 0;
+ 	argheads = 0;
+