# DF-2412 fix (authored post-verification; not applied to sys/) --- a/sys/dev/disk/advansys/advansys.c +++ b/sys/dev/disk/advansys/advansys.c @@ -1182,6 +1182,10 @@ adv_done(struct adv_softc *adv, union ccb *ccb, u_int done_stat, case SCSI_STATUS_CMD_TERMINATED: ccb->ccb_h.status |= CAM_AUTOSNS_VALID; + if (q_no == 0 || + q_no > adv->max_openings) { + /* bogus firmware q_no */ + break; + } /* Structure copy */ ccb->csio.sense_data = adv->sense_buffers[q_no - 1];