diff --git a/sys/dev/raid/iir/iir.c b/sys/dev/raid/iir/iir.c
--- a/sys/dev/raid/iir/iir.c
+++ b/sys/dev/raid/iir/iir.c
@@ -1034,7 +1034,7 @@
         gccb->gc_cmd_len = roundup(GDT_CMD_UNION + GDT_RAW_SG_LST +
                                   GDT_SG_SZ, sizeof(u_int32_t));
         cnt = ucmd->u.raw.sdlen;
-        if (cnt + ucmd->u.raw.sense_len > GDT_SCRATCH_SZ) {
+        if (cnt > GDT_SCRATCH_SZ || ucmd->u.raw.sense_len > GDT_SCRATCH_SZ - cnt) {
             kprintf("iir%d: Scratch buffer too small (%d/%d)\n",
                    gdt->sc_hanum, GDT_SCRATCH_SZ, cnt + ucmd->u.raw.sense_len);
             gdt_free_ccb(gdt, gccb);