diff --git a/src/detection/memory/memory_bsd.c b/src/detection/memory/memory_bsd.c
index 80a2c8ff1..6deadd635 100644
--- a/src/detection/memory/memory_bsd.c
+++ b/src/detection/memory/memory_bsd.c
@@ -11,11 +11,13 @@ const char* ffDetectMemory(FFMemoryResult* ram) {
     int32_t pagesFree = ffSysctlGetInt("vm.stats.vm.v_free_count", 0) + ffSysctlGetInt("vm.stats.vm.v_inactive_count", 0) + ffSysctlGetInt("vm.stats.vm.v_cache_count", 0);
     int64_t bytesCache = ffSysctlGetInt64("vfs.bufspace", 0);
 
+    ram->bytesUsed = ram->bytesTotal - (uint64_t) pagesFree * instance.state.platform.sysinfo.pageSize - (uint64_t) bytesCache;
+
     int64_t bytesArc = ffSysctlGetInt64("kstat.zfs.misc.arcstats.size", 0);
     if (bytesArc > 0) bytesArc -= ffSysctlGetInt64("kstat.zfs.misc.arcstats.c_min", 0);
-    if (bytesArc < 0) bytesArc = 0;
-
-    ram->bytesUsed = ram->bytesTotal - (uint64_t) pagesFree * instance.state.platform.sysinfo.pageSize - (uint64_t) bytesCache - (uint64_t) bytesArc;
+    if (bytesArc > 0 && (uint64_t) bytesArc < ram->bytesUsed) {
+        ram->bytesUsed -= (uint64_t) bytesArc;
+    }
 
     return NULL;
 }
diff --git a/src/detection/memory/memory_nbsd.c b/src/detection/memory/memory_nbsd.c
index 0d5ee2ff7..f7330ea31 100644
--- a/src/detection/memory/memory_nbsd.c
+++ b/src/detection/memory/memory_nbsd.c
@@ -11,12 +11,14 @@ const char* ffDetectMemory(FFMemoryResult* ram) {
         return "sysctl(CTL_VM, VM_UVMEXP2) failed";
     }
 
+    ram->bytesTotal = (uint64_t) buf.npages * instance.state.platform.sysinfo.pageSize;
+    ram->bytesUsed = ((uint64_t) buf.active + (uint64_t) buf.inactive + (uint64_t) buf.wired) * instance.state.platform.sysinfo.pageSize;
+
     int64_t bytesArc = ffSysctlGetInt64("kstat.zfs.misc.arcstats.size", 0);
     if (bytesArc > 0) bytesArc -= ffSysctlGetInt64("kstat.zfs.misc.arcstats.c_min", 0);
-    if (bytesArc < 0) bytesArc = 0;
-
-    ram->bytesTotal = (uint64_t) buf.npages * instance.state.platform.sysinfo.pageSize;
-    ram->bytesUsed = ((uint64_t) buf.active + (uint64_t) buf.inactive + (uint64_t) buf.wired) * instance.state.platform.sysinfo.pageSize - (uint64_t) bytesArc;
+    if (bytesArc > 0 && (uint64_t) bytesArc < ram->bytesUsed) {
+        ram->bytesUsed -= (uint64_t) bytesArc;
+    }
 
     return NULL;
 }