diff --git a/sys/dev/disk/vpo/vpo.c b/sys/dev/disk/vpo/vpo.c
--- a/sys/dev/disk/vpo/vpo.c
+++ b/sys/dev/disk/vpo/vpo.c
@@ -217,13 +217,13 @@
 	if (vpo->vpo_isplus) {
 		error = imm_do_scsi(&vpo->vpo_io, VP0_INITIATOR,
 			csio->ccb_h.target_id,
-			(char *)&csio->cdb_io.cdb_bytes, csio->cdb_len,
+			(char *)&csio->cdb_io.cdb_bytes, min(csio->cdb_len, IOCDBLEN),
 			(char *)csio->data_ptr, csio->dxfer_len,
 			&vpo->vpo_stat, &vpo->vpo_count, &vpo->vpo_error);
 	} else {
 		error = vpoio_do_scsi(&vpo->vpo_io, VP0_INITIATOR,
 			csio->ccb_h.target_id,
-			(char *)&csio->cdb_io.cdb_bytes, csio->cdb_len,
+			(char *)&csio->cdb_io.cdb_bytes, min(csio->cdb_len, IOCDBLEN),
 			(char *)csio->data_ptr, csio->dxfer_len,
 			&vpo->vpo_stat, &vpo->vpo_count, &vpo->vpo_error);
 	}