diff --git a/sys/dev/disk/iscsi/initiator/isc_sm.c b/sys/dev/disk/iscsi/initiator/isc_sm.c
--- a/sys/dev/disk/iscsi/initiator/isc_sm.c
+++ b/sys/dev/disk/iscsi/initiator/isc_sm.c
@@ -263,6 +263,11 @@
      pdu_t	*pp = &pq->pdu;
      bhs_t	*bhp = &pp->ipdu.bhs;
 
+     /* Reject inputs that cannot fit in u_int pq->len without wrap. */
+     if (pp->ahs_len > UINT_MAX - sizeof(bhs_t) - 8 ||
+         pp->ds_len  > UINT_MAX - sizeof(bhs_t) - 8 - pp->ahs_len)
+	  return E2BIG;
+
      len = sizeof(bhs_t);
      if(pp->ahs_len) {
 	  len += pp->ahs_len;
@@ -290,7 +295,8 @@
 
      pq->len = len;
      len -= sizeof(bhs_t);
-     if(sp->opt.maxBurstLength && (len > sp->opt.maxBurstLength)) {
+     if(sp->opt.maxBurstLength > 0 &&
+       (len > (size_t)(unsigned)sp->opt.maxBurstLength)) {
 	  xdebug("%d] pdu len=%zd > %d",
 		 sp->sid, len, sp->opt.maxBurstLength);
 	  // XXX: when this happens it used to hang ...