diff --git a/sys/dev/raid/iir/iir_ctrl.c b/sys/dev/raid/iir/iir_ctrl.c
--- a/sys/dev/raid/iir/iir_ctrl.c
+++ b/sys/dev/raid/iir/iir_ctrl.c
@@ -251,8 +251,13 @@
             ucmd->complete_flag = FALSE;
 	    crit_exit();
             gdt_next(gdt);
-            if (!ucmd->complete_flag)
-                (void) tsleep((void *)ucmd, PCATCH, "iirucw", 0);
+            /* DF-2028: keep the framework-owned ioctl buffer valid until the
+             * controller completion handler finishes writing into it; do not
+             * return to the ioctl dispatcher on a signal before complete_flag
+             * is set, otherwise mapped_ioctl frees the buffer while the
+             * controller still references it (use-after-free). */
+            while (!ucmd->complete_flag)
+                tsleep((void *)ucmd, PCATCH, "iirucw", 0);
             break;
         }