diff --git a/sys/netinet/cc.h b/sys/netinet/cc.h
index aaa1d67ae1b..332e51cdbd1 100644
--- a/sys/netinet/cc.h
+++ b/sys/netinet/cc.h
@@ -101,10 +101,12 @@ struct cc_var {
  * bits (0x01000000 - 0x80000000) are reserved for CC algos to declare their own
  * congestion signal types.
  */
-#define	CC_ECN		0x000001/* ECN marked packet received. */
-#define	CC_RTO		0x000002/* RTO fired. */
-#define	CC_RTO_ERR	0x000004/* RTO fired in error. */
-#define	CC_NDUPACK	0x000008/* Threshold of dupack's reached. */
+#define	CC_ECN		0x00000001	/* ECN marked packet received. */
+#define	CC_RTO		0x00000002	/* RTO fired. */
+#define	CC_RTO_ERR	0x00000004	/* RTO fired in error. */
+#define	CC_NDUPACK	0x00000008	/* Threshold of dupack's reached. */
+
+#define	CC_SIGPRIVMASK	0xFF000000	/* Mask to check if sig is private. */
 
 /*
  * Structure to hold data and function pointers that together represent a
diff --git a/sys/netinet/cc/cc_newreno.c b/sys/netinet/cc/cc_newreno.c
index c09554093e6..f26553ddaef 100644
--- a/sys/netinet/cc/cc_newreno.c
+++ b/sys/netinet/cc/cc_newreno.c
@@ -182,6 +182,10 @@ newreno_cong_signal(struct cc_var *ccv, uint32_t type)
 {
 	u_int win;
 
+	/* Catch algos which mistakenly leak private signal types. */
+	KASSERT((type & CC_SIGPRIVMASK) == 0,
+	    ("%s: congestion signal type 0x%08x is private\n", __func__, type));
+
 	win = max(CCV(ccv, snd_cwnd) / 2 / CCV(ccv, t_maxseg), 2) *
 	    CCV(ccv, t_maxseg);