diff --git a/sys/dev/raid/mps/mps_sas_lsi.c b/sys/dev/raid/mps/mps_sas_lsi.c
--- a/sys/dev/raid/mps/mps_sas_lsi.c
+++ b/sys/dev/raid/mps/mps_sas_lsi.c
@@ -125,7 +125,7 @@
     MPI2_EVENT_NOTIFICATION_REPLY *event)
 {
 	struct mps_fw_event_work *fw_event;
-	u16 sz;
+	u32 sz;
 
 	mps_dprint(sc, MPS_TRACE, "%s\n", __func__);
 	mps_print_evt_sas(sc, event);
@@ -138,6 +138,8 @@
 		return;
 	}
 	sz = le16toh(event->EventDataLength) * 4;
+	if (sz == 0 || sz > 65536)
+		sz = 65536;
 	fw_event->event_data = kmalloc(sz, M_MPT2, M_ZERO|M_INTWAIT);
 	if (!fw_event->event_data) {
 		kprintf("%s: allocate failed for event_data\n", __func__);