diff --git a/sys/dev/disk/advansys/adwcam.c b/sys/dev/disk/advansys/adwcam.c
--- a/sys/dev/disk/advansys/adwcam.c
+++ b/sys/dev/disk/advansys/adwcam.c
@@ -1318,8 +1318,23 @@
 				break;
 			case SCSI_STATUS_CHECK_COND:
 			case SCSI_STATUS_CMD_TERMINATED:
+				/*
+			 * DF-1510: csio->sense_len is the user-supplied
+			 * value and may exceed sizeof(struct scsi_sense_data);
+			 * acb->queue.sense_len (clamped at line 383-384) is
+			 * the number of bytes actually written by the HBA.
+			 * Use the smaller of those two as the bcopy length so
+			 * we neither leak ACB heap nor corrupt the csio fields
+			 * past sense_data.
+			 */
+			{
+				size_t blen = imin(ccb->csio.sense_len,
+						   sizeof(ccb->csio.sense_data));
+				blen = imin(blen, sizeof(acb->sense_data));
 				bcopy(&acb->sense_data, &ccb->csio.sense_data,
-				      ccb->csio.sense_len);
+				      blen);
+				ccb->csio.sense_len = (u_int8_t)blen;
+			}
 				ccb->ccb_h.status |= CAM_AUTOSNS_VALID;
 				ccb->csio.sense_resid = acb->queue.sense_len;
 				/* FALLTHROUGH */