diff --git a/sys/dev/virtual/virtio/scsi/virtio_scsi.c b/sys/dev/virtual/virtio/scsi/virtio_scsi.c
--- a/sys/dev/virtual/virtio/scsi/virtio_scsi.c
+++ b/sys/dev/virtual/virtio/scsi/virtio_scsi.c
@@ -300,6 +300,17 @@
 	sc->vtscsi_max_lun = scsicfg.max_lun;
 	sc->vtscsi_event_buf_size = scsicfg.event_info_size;
 
+	/*
+		 * vtscsi_enqueue_event_buf() bzero()s and sglist_append()s
+		 * sc->vtscsi_event_buf_size bytes starting from a single 16-byte
+		 * struct virtio_scsi_event in vtscsi_event_bufs[4].  A malicious
+		 * or buggy device advertising a larger event_info_size would
+		 * cause a heap overwrite (DF-1352).  Clamp the size to the
+		 * struct the host code actually uses.
+		 */
+	if (sc->vtscsi_event_buf_size > sizeof(struct virtio_scsi_event))
+		sc->vtscsi_event_buf_size = sizeof(struct virtio_scsi_event);
+
 	vtscsi_write_device_config(sc);
 
 	sc->vtscsi_max_nsegs = vtscsi_maximum_segments(sc, scsicfg.seg_max);