# DF-2422 fix (authored post-verification; not applied to sys/)
--- a/sys/dev/disk/ahci/ahci_cam.c
+++ b/sys/dev/disk/ahci/ahci_cam.c
@@ -1086,6 +1086,11 @@ ahci_xpt_scsi_disk_io(struct ahci_port *ap, struct ahci_at *at, union ccb *ccb)
 
 	ccbh = &ccb->ccb_h;
 	csio = &ccb->csio;
+	if ((ccbh->flags & CAM_CDB_POINTER) &&
+	    (csio->cdb_len < 6 || csio->cdb_len > 16)) {
+		ccbh->status = CAM_REQ_INVALID;
+		return;
+	}
 	cdb = (void *)((ccbh->flags & CAM_CDB_POINTER) ?
 			csio->cdb_io.cdb_ptr : csio->cdb_io.cdb_bytes);