--- a/sys/bus/cam/cam_periph.c	2026-10-21 04:27:46.575051812 +0000
+++ b/sys/bus/cam/cam_periph.c	2026-10-21 04:27:46.575051812 +0000
@@ -4,4 +4,19 @@
 			       "length 0\n");
 			return(EINVAL);
 		}
+		/*
+		 * DF-2260: num_patterns is user-controlled and was never
+		 * bounded by pattern_buf_len; xpt_action(XPT_DEV_MATCH)
+		 * walked patterns[0..num_patterns-1] past the mapped
+		 * buffer (heap OOB read / page-fault panic).
+		 */
+		if (ccb->cdm.pattern_buf_len > 0 &&
+		    ccb->cdm.num_patterns > ccb->cdm.pattern_buf_len /
+		    sizeof(struct dev_match_pattern)) {
+			kprintf("cam_periph_mapmem: num_patterns (%u) "
+				"exceeds pattern_buf_len (%u)\n",
+				ccb->cdm.num_patterns,
+				ccb->cdm.pattern_buf_len);
+			return(EINVAL);
+		}
 		if (ccb->cdm.pattern_buf_len > 0) {
\ No newline at end of file