--- a/sys/bus/cam/scsi/scsi_pass.c	2026-10-21 07:51:39.509828345 +0000
+++ b/sys/bus/cam/scsi/scsi_pass.c	2026-10-21 07:51:39.521828192 +0000
@@ -1,3 +1,27 @@
 	ccb->ccb_h.cbfcnp = NULL;
 	ccb->ccb_h.periph_priv = inccb->ccb_h.periph_priv;
-	bcopy(ccb, inccb, sizeof(union ccb));
\ No newline at end of file
+	{
+		/*
+		 * DF-2277: copy back through a scrubbed SHADOW ccb so no
+		 * kernel pointer fields (path cam_path*, timeout_ch
+		 * callout*, sim_priv SIM softc*, stale list links) are
+		 * disclosed to userspace.  The live kernel CCB is left
+		 * untouched: its path/timeout_ch are still needed by
+		 * xpt_release_ccb()/xpt_free_ccb() after we return.
+		 */
+		union ccb df_out;
+
+		bcopy(ccb, &df_out, sizeof(df_out));
+		df_out.ccb_h.cbfcnp = NULL;
+		df_out.ccb_h.path = NULL;
+		df_out.ccb_h.timeout_ch = NULL;
+		df_out.ccb_h.sim_priv.entries[0].ptr = NULL;
+		df_out.ccb_h.sim_priv.entries[1].ptr = NULL;
+		df_out.ccb_h.xpt_links.sle.sle_next = NULL;
+		df_out.ccb_h.sim_links.sle.sle_next = NULL;
+		df_out.ccb_h.periph_links.sle.sle_next = NULL;
+		df_out.ccb_h.xpt_links.tqe.tqe_next = NULL;
+		df_out.ccb_h.sim_links.tqe.tqe_next = NULL;
+		df_out.ccb_h.periph_links.tqe.tqe_next = NULL;
+		bcopy(&df_out, inccb, sizeof(union ccb));
+	}
\ No newline at end of file