--- scsi_da.c.orig
+++ scsi_da.c.orig
@@ -440,8 +440,26 @@
 		bytes_start = del_num[0];
 
 		/* TRIM occurs on 512-byte sectors. */
-		KKASSERT((bytes_left % 512) == 0);
-		KKASSERT((bytes_start% 512) == 0);
+		/*
+		 * Validate the user-supplied byte range instead of
+		 * asserting on it: a bad length or offset must fail
+		 * with EINVAL, not panic the system (DF-2275).
+		 *
+		 * Negative values must also be rejected (DF-2276):
+		 * they can be 512-aligned and pass an alignment-only
+		 * check, but byte_count = MIN(bytes_left, 0x7FFF8000)
+		 * keeps the negative off_t, and the assignment to the
+		 * int byte_count truncates LLONG_MIN to 0 (infinite
+		 * loop issuing zero-block TRIMs) or keeps smaller
+		 * negatives as a negative b_bcount handed to
+		 * dev_dstrategy().
+		 */
+		if (bytes_start < 0 || bytes_left < 0)
+			return(EINVAL);
+		if ((bytes_left % 512) != 0)
+			return(EINVAL);
+		if ((bytes_start % 512) != 0)
+			return(EINVAL);
 
 		
 		/* Break TRIM up into int-sized commands because of b_bcount */