diff --git a/sys/dev/raid/arcmsr/arcmsr.c b/sys/dev/raid/arcmsr/arcmsr.c
--- a/sys/dev/raid/arcmsr/arcmsr.c
+++ b/sys/dev/raid/arcmsr/arcmsr.c
@@ -1444,6 +1444,11 @@
 
 	iop_data = (u_int32_t *)prbuffer->data;
 	iop_len = (u_int32_t)prbuffer->data_len;
+	/* data_len is firmware-controlled and only bounded to ARCMSR_MAX_QBUFFER-1
+	 * by the caller, but buf1 below is a 128-byte object and prbuffer->data is
+	 * itself only 124 bytes.  Clamp to the copy buffer / data field size. */
+	if (iop_len > sizeof(prbuffer->data))
+		iop_len = sizeof(prbuffer->data);
 	if ( iop_len > 0 )
 	{
 		buf1 = kmalloc(128, M_DEVBUF, M_NOWAIT | M_ZERO);