diff --git a/src/core/SkScalerContext.cpp b/src/core/SkScalerContext.cpp
index 85edc26a3f7..0c4f2e2ce0c 100644
--- a/src/core/SkScalerContext.cpp
+++ b/src/core/SkScalerContext.cpp
@@ -575,7 +575,14 @@ void SkScalerContext::GenerateImageFromPath(
     } else {
         dst.reset(info, dstMask.image(), dstMask.fRowBytes);
     }
-    sk_bzero(dst.writable_addr(), dst.computeByteSize());
+    // When we are writing directly into the caller's buffer (no intermediate
+    // dst), zero the *full* mask image (fRowBytes * height). dst is an A8
+    // pixmap and SkPixmap::computeByteSize() returns
+    // (H-1)*rowBytes + W*bytesPerPixel(A8=1), which can be smaller than the
+    // caller's allocation when fRowBytes > W (e.g. dstMask is kARGB32_Format),
+    // leaving the trailing bytes uninitialized.
+    sk_bzero(dst.writable_addr(),
+             intermediateDst ? dst.computeByteSize() : dstMask.computeImageSize());
 
     skcpu::Draw draw;
     draw.fBlitterChooser = SkA8Blitter_Choose;