--- a/sys/dev/raid/twa/tw_cl_io.c
+++ b/sys/dev/raid/twa/tw_cl_io.c
@@ -322,6 +322,17 @@
 			(TW_UINT8)(TW_CL_SWAP16(req->request_id));
 		if ((sgl_offset =
 			GET_SGL_OFF(cmd_7k->generic.sgl_off__opcode))) {
+			/* Validate sgl offset against cmd_7k region size. */
+			TW_UINT32 off_dwords;
+			if (ctlr->device_id == TW_CL_DEVICE_ID_9K_SA)
+				off_dwords = cmd_7k->generic.size;
+			else
+				off_dwords = sgl_offset;
+			if (off_dwords >= sizeof(union tw_cl_command_7k) / 4) {
+				error = TW_OSL_EIO;
+				tw_cli_req_q_insert_tail(req, TW_CLI_FREE_Q);
+				return(error);
+			}
 			if (ctlr->device_id == TW_CL_DEVICE_ID_9K_SA)
 				sgl = (((TW_UINT32 *)cmd_7k) + cmd_7k->generic.size);
 			else