diff --git a/sys/dev/disk/trm/trm.c b/sys/dev/disk/trm/trm.c
--- a/sys/dev/disk/trm/trm.c
+++ b/sys/dev/disk/trm/trm.c
@@ -589,6 +589,19 @@
 	    		pccb->ccb_h.ccb_trmacb_ptr = pACB;
 		    	pSRB->pccb = pccb;
 			pSRB->ScsiCmdLen = pcsio->cdb_len;
+			/*
+			 * Reject CDBs that do not fit in CmdBlock[12]. Without this
+			 * check, the bcopy below overflows into Segment0 / Segment1 /
+			 * pNextSRB / pSRBDCB / pSRBSGL / pccb on cdb_len > 12.
+			 */
+			if (pcsio->cdb_len > sizeof(pSRB->CmdBlock)) {
+				pSRB->pNextSRB = pACB->pFreeSRB;
+				pACB->pFreeSRB = pSRB;
+				pccb->ccb_h.status = CAM_REQ_INVALID;
+				xpt_done(pccb);
+				crit_exit();
+				return;
+			}
 			/* 
 			 * move layer of CAM command block to layer of SCSI
 			 * Request Block for SCSI processor command doing