diff --git a/sys/dev/raid/asr/asr.c b/sys/dev/raid/asr/asr.c
--- a/sys/dev/raid/asr/asr.c
+++ b/sys/dev/raid/asr/asr.c
@@ -483,7 +483,7 @@
  *	Fill message with default.
  */
 static PI2O_MESSAGE_FRAME
-ASR_fillMessage(void *Message, u_int16_t size)
+ASR_fillMessage(void *Message, u_int32_t size)
 {
 	PI2O_MESSAGE_FRAME Message_Ptr;
 
@@ -3262,6 +3262,14 @@
 	ReplySizeInBytes = (I2O_MESSAGE_FRAME_getMessageSize(
 	  &(Reply_Ptr->StdReplyFrame.StdMessageFrame)) << 2);
 	kfree(Reply_Ptr, M_TEMP);
+	/*
+	 * The reply MessageSize is user-controlled and reaches up to
+	 * 0xFFFF<<2 = 256 KB. Cap it at MAX_INBOUND_SIZE -- ASR_fillMessage
+	 * would otherwise truncate the size to u_int16_t (silent partial
+	 * bzero) and copyout would leak the unzeroed slab to userspace.
+	 */
+	if (ReplySizeInBytes > MAX_INBOUND_SIZE)
+		ReplySizeInBytes = MAX_INBOUND_SIZE;
 	if (ReplySizeInBytes < sizeof(I2O_SINGLE_REPLY_MESSAGE_FRAME)) {
 		kfree(Message_Ptr, M_TEMP);
 		debug_usr_cmd_printf (