diff --git a/sys/dev/disk/iscsi/initiator/isc_sm.c b/sys/dev/disk/iscsi/initiator/isc_sm.c
--- a/sys/dev/disk/iscsi/initiator/isc_sm.c
+++ b/sys/dev/disk/iscsi/initiator/isc_sm.c
@@ -265,6 +265,10 @@
 
      len = sizeof(bhs_t);
      if(pp->ahs_len) {
+	  /* AHS length must be a multiple of 4 (RFC 3720); otherwise the
+	   * i_send padding loop writes up to 3 bytes OOB. */
+	  if (pp->ahs_len & 0x3)
+	       return EINVAL;
 	  len += pp->ahs_len;
 	  bhp->AHSLength =  pp->ahs_len / 4;
      }