diff --git a/sys/dev/raid/arcmsr/arcmsr.c b/sys/dev/raid/arcmsr/arcmsr.c
--- a/sys/dev/raid/arcmsr/arcmsr.c
+++ b/sys/dev/raid/arcmsr/arcmsr.c
@@ -2618,7 +2618,13 @@
 		retvalue = ARCMSR_MESSAGE_FAIL;
 		goto message_out;
 	}
-	if (transfer_len > sizeof(struct CMD_MESSAGE_FIELD)) {
+	/* DF-1185: the buffer is dxfer_len bytes; CMD_MESSAGE_FIELD is
+	 * ~1060 bytes (cmdmessage + messagedatabuffer[1032]).  The
+	 * code below writes up to 1031 bytes into messagedatabuffer
+	 * (offset 28).  Reject any transfer_len that does not match
+	 * the full CMD_MESSAGE_FIELD size so the aliasing cast is
+	 * always within the CAM allocation. */
+	if (transfer_len != sizeof(struct CMD_MESSAGE_FIELD)) {
 		retvalue = ARCMSR_MESSAGE_FAIL;
 		goto message_out;
 	}