diff --git a/sys/bsm/audit_errno.h b/sys/bsm/audit_errno.h
index 9a13bd9c3c9..8b781996484 100644
--- a/sys/bsm/audit_errno.h
+++ b/sys/bsm/audit_errno.h
@@ -205,6 +205,8 @@
 #define	BSM_ERRNO_EKEYEXPIRED		220	/* Linux-specific. */
 #define	BSM_ERRNO_EKEYREVOKED		221	/* Linux-specific. */
 #define	BSM_ERRNO_EKEYREJECTED		222	/* Linux-specific. */
+#define	BSM_ERRNO_ENOTCAPABLE		223	/* FreeBSD-specific. */
+#define	BSM_ERRNO_ECAPMODE		224	/* FreeBSD-specific. */
 
 /*
  * In the event that OpenBSM doesn't have a file representation of a local
diff --git a/sys/security/audit/audit_bsm_errno.c b/sys/security/audit/audit_bsm_errno.c
index efbc8668407..c7aa9afc90d 100644
--- a/sys/security/audit/audit_bsm_errno.c
+++ b/sys/security/audit/audit_bsm_errno.c
@@ -686,6 +686,20 @@ static const struct bsm_errno bsm_errnos[] = {
 	ERRNO_NO_LOCAL_MAPPING,
 #endif
 	ES("Key was rejected by service") },
+	{ BSM_ERRNO_ENOTCAPABLE,
+#ifdef ENOTCAPABLE
+	ENOTCAPABLE,
+#else
+	ERRNO_NO_LOCAL_MAPPING,
+#endif
+	ES("Capabilities insufficient") },
+	{ BSM_ERRNO_ECAPMODE,
+#ifdef ECAPMODE
+	ECAPMODE,
+#else
+	ERRNO_NO_LOCAL_MAPPING,
+#endif
+	ES("Not permitted in capability mode") },
 };
 static const int bsm_errnos_count = sizeof(bsm_errnos) / sizeof(bsm_errnos[0]);
 
diff --git a/sys/sys/errno.h b/sys/sys/errno.h
index 1fceb007c18..da7ab848d5c 100644
--- a/sys/sys/errno.h
+++ b/sys/sys/errno.h
@@ -175,10 +175,11 @@ __END_DECLS
 
 #ifndef _POSIX_SOURCE
 #define	ENOTCAPABLE	93		/* Capabilities insufficient */
+#define	ECAPMODE		94		/* Not permitted in capability mode */
 #endif /* _POSIX_SOURCE */
 
 #ifndef _POSIX_SOURCE
-#define	ELAST		93		/* Must be equal largest errno */
+#define	ELAST		94		/* Must be equal largest errno */
 #endif /* _POSIX_SOURCE */
 
 #ifdef _KERNEL