diff --git a/sys/dev/raid/mps/mps_config.c b/sys/dev/raid/mps/mps_config.c
--- a/sys/dev/raid/mps/mps_config.c
+++ b/sys/dev/raid/mps/mps_config.c
@@ -1114,7 +1114,17 @@
 		error = ENXIO;
 		goto out;
 	}
-	bcopy(page, config_page, cm->cm_length);
+	/* DF-1556: bound the final copy by the caller's buffer capacity, not
+	 * by the firmware-supplied PageLength.  The sole in-tree caller
+	 * (mps_wd_config_pages) allocates sizeof(Mpi2RaidVolPage0_t) +
+	 * sizeof(Mpi2RaidVol0PhysDisk_t) * MPS_MAX_DISKS_IN_VOL bytes;
+	 * a malicious/compromised HBA can return PageLength up to 65535,
+	 * overflowing that buffer.  Every sibling getter in this file uses
+	 * MIN(); this one is the only unbounded bcopy.
+	 */
+	bcopy(page, config_page,
+	    MIN(cm->cm_length, sizeof(Mpi2RaidVolPage0_t) +
+	    sizeof(Mpi2RaidVol0PhysDisk_t) * MPS_MAX_DISKS_IN_VOL));
 out:
 	kfree(page, M_MPT2);
 	if (cm)