Fatal user address access from kernel mode from pass2422 at ffffffff80305600
Fatal trap 12: page fault while in kernel mode
fault virtual address	= 0x800474001        (cdb page + 1: byte 7..9 of the CDB, past cdb_len=6)
Stopped at      ahci_xpt_scsi_disk_io+0x8f0:    movzwl  0x7(%r13),%ecx

movzwl 0x7(%r13) = the 16-bit rw_10 block-count field at cdb+7 -- read
unconditionally although csio->cdb_len was 6.  The ATAPI sibling path
validates cdb_len (ahci_cam.c:1512); the DISK path does not.