diff --git a/sys/bus/cam/cam_xpt.c b/sys/bus/cam/cam_xpt.c
--- a/sys/bus/cam/cam_xpt.c
+++ b/sys/bus/cam/cam_xpt.c
@@ -2441,12 +2441,12 @@
 		return(0);
 	}
 
-	if ((cdm->pos.position_type & CAM_DEV_POS_BUS)
-	 && (cdm->pos.cookie.bus != NULL))
-		ret = xptbustraverse((struct cam_eb *)cdm->pos.cookie.bus,
-				     xptedtbusfunc, cdm);
-	else
-		ret = xptbustraverse(NULL, xptedtbusfunc, cdm);
+	/*
+		 * DF-0975: user-supplied cookie pointers are not validated;
+		 * ignore them and always traverse from the head so we cannot
+		 * dereference an attacker-controlled kernel pointer.
+		 */
+	ret = xptbustraverse(NULL, xptedtbusfunc, cdm);
 
 	/*
 	 * If we get back 0, that means that we had to stop before fully