diff --git a/sys/dev/disk/iscsi/initiator/iscsi_subr.c b/sys/dev/disk/iscsi/initiator/iscsi_subr.c
--- a/sys/dev/disk/iscsi/initiator/iscsi_subr.c
+++ b/sys/dev/disk/iscsi/initiator/iscsi_subr.c
@@ -564,12 +564,18 @@
 				csio->data_ptr, bp? mtod(pq->mp, caddr_t): 0,
 				ntohl(cmd->edtlen), pq->pdu.ds_len, pq->mp);
 			 if(ntohl(cmd->edtlen) >= pq->pdu.ds_len) {
-			      int		offset, len = pq->pdu.ds_len;
+			      u_int		offset, len = pq->pdu.ds_len;
+			      u_int		edtlen = ntohl(cmd->edtlen);
 
 			      if(pq->mp != NULL) {
 			      caddr_t		dp;
 
 			      offset = ntohl(rcmd->bo);
+			      if (offset > edtlen || len > edtlen - offset) {
+				   xdebug("bad data-in bo=%u len=%u edtlen=%u",
+					  offset, len, edtlen);
+				   break;
+				   }
 			      dp = csio->data_ptr + offset;
 			      i_mbufcopy(pq->mp, dp, len);
 			 }