diff --git a/sys/dev/disk/nata/ata-lowlevel.c b/sys/dev/disk/nata/ata-lowlevel.c
--- a/sys/dev/disk/nata/ata-lowlevel.c
+++ b/sys/dev/disk/nata/ata-lowlevel.c
@@ -332,6 +332,14 @@
 	if (request->flags & ATA_R_TIMEOUT)
 	    goto end_finished;
 
+	/* DF-1737: bound device-reported byte count to remaining request
+	 * bytes.  A malicious or buggy ATAPI device (USB-C/SATA bridge,
+	 * crafted firmware, malicious emulator) can report a count larger
+	 * than request->bytecount, which would let request->donecount
+	 * advance past request->data and cause an OOB PIO write/read. */
+	if (length > request->bytecount - request->donecount)
+	    length = request->bytecount - request->donecount;
+
 	switch ((ATA_IDX_INB(ch, ATA_IREASON) & (ATA_I_CMD | ATA_I_IN)) |
 		(request->status & ATA_S_DRQ)) {