--- a/sys/bus/cam/scsi/scsi_pass.c
+++ b/sys/bus/cam/scsi/scsi_pass.c
@@ -471,6 +471,29 @@
 		 * Some CCB types, like scan bus and scan lun can only go
 		 * through the transport layer device.
 		 */
+		switch (inccb->ccb_h.func_code) {
+		case XPT_GDEVLIST:	/* walks kernel periph lists  */
+		case XPT_REL_SIMQ:	/* releases sim queue locks   */
+		case XPT_TERM_IO:	/* kernel-only terminate path */
+			/*
+			 * These function codes operate on kernel-only
+			 * objects and their results embed kernel
+			 * pointers.  They must not be issued from
+			 * userland through CAMIOCOMMAND (the full CCB
+			 * is copied back out by passsendccb()).
+			 * XPT_DEV_MATCH / XPT_RESET_BUS are already
+			 * gated as XPT_FC_XPT_ONLY below.
+			 */
+			xpt_print(periph->path, "CCB function code %#x is "
+			    "kernel-only\n", inccb->ccb_h.func_code);
+			error = ENODEV;
+			break;
+		default:
+			break;
+		}
+		if (error == ENODEV)
+			break;
+
 		if (inccb->ccb_h.func_code & XPT_FC_XPT_ONLY) {
 			xpt_print(periph->path, "CCB function code %#x is "
 			    "restricted to the XPT device\n",