--- /home/maxx/dfbsd/dfbsd/sys/dev/disk/isp/isp_freebsd.c	2026-06-29 12:51:18.000000000 +0000
+++ sys/dev/disk/isp/isp_freebsd.c	2026-10-24 09:11:15.579214449 +0000
@@ -1923,8 +1923,16 @@
 	}
 
 	atiop->init_id = GET_IID_VAL(aep->at_iid);
-	atiop->cdb_len = aep->at_cdblen;
-	ISP_MEMCPY(atiop->cdb_io.cdb_bytes, aep->at_cdb, aep->at_cdblen);
+	{
+		size_t cdblen = aep->at_cdblen;
+		if (cdblen > sizeof (atiop->cdb_io.cdb_bytes)) {
+			isp_prt(isp, ISP_LOGWARN, "overlong ATIO CDB %u",
+			    aep->at_cdblen);
+			cdblen = sizeof (atiop->cdb_io.cdb_bytes);
+		}
+		atiop->cdb_len = cdblen;
+		ISP_MEMCPY(atiop->cdb_io.cdb_bytes, aep->at_cdb, cdblen);
+	}
 	atiop->ccb_h.status = CAM_CDB_RECVD;
 	/*
 	 * Construct a tag 'id' based upon tag value (which may be 0..255)