diff --git a/sys/bus/cam/scsi/scsi_sg.c b/sys/bus/cam/scsi/scsi_sg.c
--- a/sys/bus/cam/scsi/scsi_sg.c
+++ b/sys/bus/cam/scsi/scsi_sg.c
@@ -695,6 +695,10 @@
 	 * Now set up the data block.  Again, the designers didn't bother
 	 * to make this reliable.
 	 */
+	if (uio->uio_resid < 0 || uio->uio_resid > SG_MAX_SENSE) {
+		error = EINVAL;
+		goto out_ccb;
+	}
 	buf_len = uio->uio_resid;
 	if (buf_len != 0) {
 		buf = kmalloc(buf_len, M_DEVBUF, M_WAITOK | M_ZERO);
@@ -703,6 +707,10 @@
 			goto out_buf;
 		dir = CAM_DIR_OUT;
 	} else if (hdr->reply_len != 0) {
+		if (hdr->reply_len < 0 || hdr->reply_len > SG_MAX_SENSE) {
+			error = EINVAL;
+			goto out_ccb;
+		}
 		buf = kmalloc(hdr->reply_len, M_DEVBUF, M_WAITOK | M_ZERO);
 		buf_len = hdr->reply_len;
 		dir = CAM_DIR_IN;