diff --git a/sys/bus/cam/scsi/scsi_da.c b/sys/bus/cam/scsi/scsi_da.c
--- a/sys/bus/cam/scsi/scsi_da.c
+++ b/sys/bus/cam/scsi/scsi_da.c
@@ -2285,6 +2285,15 @@
 
 	softc = (struct da_softc *)periph->softc;
 
+	/*
+	 * Validate block_len: it is used as a divisor at 7 sites
+	 * (dadump, dastart TRIM, dastart RW). A malicious device can
+	 * return READ_CAPACITY with length=0, causing secsize=0 and a
+	 * fatal #DE trap on the first I/O. Fall back to 512 if invalid.
+	 */
+	if (block_len < 512 || block_len > MAXPHYS)
+		block_len = 512;
+
 	dp = &softc->params;
 	dp->secsize = block_len;
 	dp->sectors = maxsector + 1;