diff --git a/sys/dev/disk/iscsi/initiator/isc_soc.c b/sys/dev/disk/iscsi/initiator/isc_soc.c
--- a/sys/dev/disk/iscsi/initiator/isc_soc.c
+++ b/sys/dev/disk/iscsi/initiator/isc_soc.c
@@ -443,11 +443,11 @@
 			 scsi_req_t *cmd		= &opp->ipdu.scsi_req;
 			 data_in_t *rcmd		= &pq->pdu.ipdu.data_in;
 			 bhs_t *bhp			= &opp->ipdu.bhs;
-			 int	r;
 
 			 if(bhp->opcode == ISCSI_SCSI_CMD
 			    && cmd->R
-			    && (ntohl(cmd->edtlen) >= pq->pdu.ds_len)) {
+			    && (ntohl(cmd->edtlen) >= pq->pdu.ds_len)
+				 && (ntohl(rcmd->bo) + pq->pdu.ds_len <= ntohl(cmd->edtlen))) {
 			      struct iovec *iov = pq->iov;
 			      iov->iov_base = csio->data_ptr + ntohl(rcmd->bo);
 			      iov->iov_len = pq->pdu.ds_len;
@@ -457,7 +457,7 @@
 			      uio->uio_iov = iov;
 			      uio->uio_iovcnt = 1;
 			      if(len > pq->pdu.ds_len) {
-				   pq->iov[1].iov_base = &r;
+				   pq->iov[1].iov_base = NULL;
 				   pq->iov[1].iov_len = len - pq->pdu.ds_len;
 				   uio->uio_iovcnt++;
 			      }