--- a/sys/dev/disk/amd/amd.c	2026-10-12 08:52:52.987282431 +0000
+++ b/sys/dev/disk/amd/amd.c	2026-10-12 08:52:52.999282276 +0000
@@ -393,6 +393,19 @@
 			xpt_done(pccb);
 			return;
 		}
+		/*
+		 * DF-2425: CmdBlock is 12 bytes; cdb_len is an
+		 * attacker-controlled u_int8_t forwarded verbatim by
+		 * pass(4)/xpt_merge_ccb().  Reject anything that does
+		 * not fit before the bcopy below overflows the SRB
+		 * (pccb/dmamap/pSGlist sit immediately after CmdBlock).
+		 */
+		if (pcsio->cdb_len > sizeof(pSRB->CmdBlock)) {
+			TAILQ_INSERT_HEAD(&amd->free_srbs, pSRB, links);
+			pccb->ccb_h.status = CAM_REQ_INVALID;
+			xpt_done(pccb);
+			return;
+		}
 		pSRB->pccb = pccb;
 		pccb->ccb_h.ccb_srb_ptr = pSRB;
 		pccb->ccb_h.ccb_amd_ptr = amd;