diff --git a/sys/dev/raid/mps/mps_user.c b/sys/dev/raid/mps/mps_user.c
--- a/sys/dev/raid/mps/mps_user.c
+++ b/sys/dev/raid/mps/mps_user.c
@@ -1580,8 +1580,9 @@
 	/*
 	 * Make sure requested read is within limits
 	 */
-	if (diag_read_buffer->StartingOffset + diag_read_buffer->BytesToRead >
-	    pBuffer->size) {
+	if (diag_read_buffer->StartingOffset > pBuffer->size ||
+	    diag_read_buffer->BytesToRead >
+	    pBuffer->size - diag_read_buffer->StartingOffset) {
 		*return_code = MPS_FW_DIAG_ERROR_INVALID_PARAMETER;
 		return (MPS_DIAG_FAILURE);
 	}