diff --git a/sys/kern/kern_prot.c b/sys/kern/kern_prot.c
index 6a1789813c05..f98135a22e2a 100644
--- a/sys/kern/kern_prot.c
+++ b/sys/kern/kern_prot.c
@@ -1569,7 +1569,12 @@ p_candebug(struct proc *p1, struct proc *p2)
 			return (error);
 	}
 
-	/* can't trace a process that's currently exec'ing */
+	/*
+	 * Can't trace a process that's currently exec'ing.
+	 * XXX: Note, this is not a security policy decision, it's a
+	 * basic correctness/functionality decision.  Therefore, this check
+	 * should be moved to the caller's of p_candebug().
+	 */
 	if ((p2->p_flag & P_INEXEC) != 0)
 		return (EAGAIN);