diff --git a/sys/dev/disk/trm/trm.c b/sys/dev/disk/trm/trm.c
--- a/sys/dev/disk/trm/trm.c
+++ b/sys/dev/disk/trm/trm.c
@@ -1955,6 +1955,21 @@
 	  /* 
    	   * Parsing incomming extented messages 
 	   */
+		/* DF-1236: bound-check pMsgPtr against MsgInBuf. A malicious SCSI
+		 * target can otherwise send a never-terminating EXTENDED message
+		 * (code != 1/3) and drive pMsgPtr past MsgInBuf[6] (trm.h) into
+		 * MsgOutBuf / MsgCnt / TagNumber and adjacent heap. */
+		if (pSRB->pMsgPtr >=
+		    &pSRB->MsgInBuf[sizeof(pSRB->MsgInBuf)]) {
+			pSRB->SRBState &= ~SRB_EXTEND_MSGIN;
+			pSRB->MsgCnt = 1;
+			pSRB->MsgInBuf[0] = MSG_REJECT_;
+			trm_reg_write16(DO_SETATN, TRMREG_SCSI_CONTROL);
+			*pscsi_status = PH_BUS_FREE;
+			trm_reg_write16(DO_DATALATCH, TRMREG_SCSI_CONTROL);
+			trm_reg_write8(SCMD_MSGACCEPT, TRMREG_SCSI_COMMAND);
+			return;
+		}
 		*pSRB->pMsgPtr = message_in_code;
 		pSRB->MsgCnt++;
 		pSRB->pMsgPtr++;