diff --git a/sys/dev/disk/advansys/advansys.c b/sys/dev/disk/advansys/advansys.c
--- a/sys/dev/disk/advansys/advansys.c
+++ b/sys/dev/disk/advansys/advansys.c
@@ -562,7 +562,14 @@
 	scsiq.q2.target_ix = ADV_TIDLUN_TO_IX(ccb_h->target_id,
 					      ccb_h->target_lun);
 	scsiq.q2.flag = 0;
-	scsiq.q2.cdb_len = csio->cdb_len;
+	/*
+	 * DF-1547: csio->cdb_len is a u8 (0..255) attacker-controlled via
+	 * CAMIOCOMMAND/xpt_merge_ccb; cdb_bytes is u8[IOCDBLEN=16] and the
+	 * LRAM CDB slot is 28 bytes.  Clamp to IOCDBLEN so adv_write_lram
+	 * cannot write past the slot, and so we do not read past cdb_bytes
+	 * (which would leak adjacent csio fields back to the firmware).
+	 */
+	scsiq.q2.cdb_len = imin(csio->cdb_len, IOCDBLEN);
 	if ((ccb_h->flags & CAM_TAG_ACTION_VALID) != 0)
 		scsiq.q2.tag_code = csio->tag_action;
 	else