diff --git a/sys/dev/raid/mpr/mpr_user.c b/sys/dev/raid/mpr/mpr_user.c
--- a/sys/dev/raid/mpr/mpr_user.c
+++ b/sys/dev/raid/mpr/mpr_user.c
@@ -1793,10 +1793,14 @@
 	pBuffer = &sc->fw_diag_buffer_list[i];
 
 	/*
-	 * Make sure requested read is within limits
+	 * Make sure requested read is within limits.  Check each bound
+	 * independently to avoid an integer overflow on the sum
+	 * (StartingOffset + BytesToRead) that previously allowed the wrapped
+	 * sum to pass the check and produced an out-of-bounds copyout.
 	 */
-	if (diag_read_buffer->StartingOffset + diag_read_buffer->BytesToRead >
-	    pBuffer->size) {
+	if (diag_read_buffer->StartingOffset >= pBuffer->size ||
+	    diag_read_buffer->BytesToRead >
+	    pBuffer->size - diag_read_buffer->StartingOffset) {
 		*return_code = MPR_FW_DIAG_ERROR_INVALID_PARAMETER;
 		return (MPR_DIAG_FAILURE);
 	}