--- a/sys/bus/cam/scsi/scsi_ses.c	2026-10-21 04:28:14.598687354 +0000
+++ b/sys/bus/cam/scsi/scsi_ses.c	2026-10-21 04:28:14.606687251 +0000
@@ -1,4 +1,10 @@
 		cam_periph_lock(periph);
+		/*
+		 * DF-2280: ses_object has 2 bytes of tail padding that the
+		 * field writes below never touch; zero the whole struct so
+		 * copyout cannot disclose stale kernel-stack bytes.
+		 */
+		bzero(&obj, sizeof(obj));
 		for (uobj = addr, i = 0; i != ssc->ses_nobjects; i++, uobj++) {
 			obj.obj_id = i;
 			obj.subencid = ssc->ses_objmap[i].subenclosure;