--- /tmp/orig/bus/iicbus/iic.c	2026-07-23 11:54:56.754823000 +0000
+++ bus/iicbus/iic.c	2026-07-23 11:57:17.676284000 +0000
@@ -351,15 +351,18 @@
 		buf = kmalloc(sizeof(*d->msgs) * d->nmsgs, M_TEMP, M_WAITOK);
 		usrbufs = kmalloc(sizeof(void *) * d->nmsgs, M_TEMP, M_ZERO | M_WAITOK);
 		error = copyin(d->msgs, buf, sizeof(*d->msgs) * d->nmsgs);
-		if (error)
+		if (error) {
+			kfree(usrbufs, M_TEMP);
 			break;
+		}
 		/* Alloc kernel buffers for userland data, copyin write data */
 		for (i = 0; i < d->nmsgs; i++) {
 			m = &((struct iic_msg *)buf)[i];
 			usrbufs[i] = m->buf;
-			m->buf = kmalloc(m->len, M_TEMP, M_WAITOK);
+			m->buf = kmalloc(m->len, M_TEMP, M_WAITOK | M_ZERO);
 			if (!(m->flags & IIC_M_RD))
-				copyin(usrbufs[i], m->buf, m->len);
+				if (copyin(usrbufs[i], m->buf, m->len))
+					m->len = 0;
 		}
 		error = iicbus_transfer(parent, (struct iic_msg *)buf, d->nmsgs);
 		/* Copyout all read segments, free up kernel buffers */