--- a/sys/bus/cam/scsi/scsi_pass.c	2026-10-21 04:28:14.594687408 +0000
+++ b/sys/bus/cam/scsi/scsi_pass.c	2026-10-21 04:28:14.594687408 +0000
@@ -1,3 +1,18 @@
+	/*
+	 * DF-2278: physical-address transfer modes are not supported.
+	 * passsendccb previously treated CAM_DATA_PHYS only as a hint to
+	 * skip cam_periph_mapmem() and forwarded the raw user value in
+	 * csio.data_ptr to the SIM, which consumes it as a kernel/DMA
+	 * address (demonstrated: kernel page fault in atapi-cam
+	 * ata_pio_read on a stock kernel).  Reject instead.
+	 */
+	if (ccb->ccb_h.func_code == XPT_SCSI_IO &&
+	    (ccb->ccb_h.flags & (CAM_DATA_PHYS | CAM_SG_LIST_PHYS)) != 0) {
+		xpt_print(periph->path, "CAM_DATA_PHYS and "
+			  "CAM_SG_LIST_PHYS are not supported by pass\n");
+		return (EINVAL);
+	}
+
 	if (((ccb->ccb_h.flags & CAM_DATA_PHYS) == 0)
 	 && (((ccb->ccb_h.func_code == XPT_SCSI_IO)
 	    && ((ccb->ccb_h.flags & CAM_DIR_MASK) != CAM_DIR_NONE))