diff --git a/sys/dev/disk/advansys/advansys.c b/sys/dev/disk/advansys/advansys.c
--- a/sys/dev/disk/advansys/advansys.c
+++ b/sys/dev/disk/advansys/advansys.c
@@ -556,7 +556,13 @@
 	scsiq.q1.sg_queue_cnt = 0;
 	scsiq.q1.target_id = ADV_TID_TO_TARGET_MASK(ccb_h->target_id);
 	scsiq.q1.target_lun = ccb_h->target_lun;
-	scsiq.q1.sense_len = csio->sense_len;
+	/*
+	 * DF-1546: csio->sense_len is a u8 (0..255) attacker-controlled via
+	 * CAMIOCOMMAND/xpt_merge_ccb; the firmware DMAs sense into 32-byte
+	 * slots (sizeof(struct scsi_sense_data)).  Clamp before handing to
+	 * the firmware so it cannot overflow its DMA target.
+	 */
+	scsiq.q1.sense_len = imin(csio->sense_len, sizeof(csio->sense_data));
 	scsiq.q1.extra_bytes = 0;
 	scsiq.q2.ccb_index = cinfo - adv->ccb_infos;
 	scsiq.q2.target_ix = ADV_TIDLUN_TO_IX(ccb_h->target_id,