diff --git a/sys/dev/disk/iscsi/initiator/isc_sm.c b/sys/dev/disk/iscsi/initiator/isc_sm.c
--- a/sys/dev/disk/iscsi/initiator/isc_sm.c
+++ b/sys/dev/disk/iscsi/initiator/isc_sm.c
@@ -84,6 +84,20 @@
      int	itt;
 
      debug_called(8);
+     /*
+      | A REJECT with no AHS, no data segment and no digests leaves
+      | pq->mp == NULL (so_recv only assigns pq->mp when there is
+      | payload to read).  A malicious target can send such a PDU;
+      | dereferencing it via mtod() below would page-fault at a low
+      | address.  Without the data segment we cannot map the REJECT
+      | back to a specific task tag, so drop it.
+      */
+     if (pq->mp == NULL) {
+	  xdebug("%d] REJECT with NULL mbuf (no data segment) - dropping",
+		 sp->sid);
+	  pdu_free(sp->isc, pq);
+	  return;
+     }
      pdu = mtod(pq->mp, pdu_t *);
      itt = pdu->ipdu.bhs.itt;
      reject = &pq->pdu.ipdu.reject;