--- /home/maxx/dfbsd/dfbsd/sys/dev/disk/mmcsd/mmcsd.c	2026-07-22 16:41:59.436308740 +0000
+++ /tmp/opencode/fixtree/sys/dev/disk/mmcsd/mmcsd.c	2026-10-24 09:23:04.654129051 +0000
@@ -326,7 +326,7 @@
 static daddr_t
 mmcsd_rw(struct mmcsd_softc *sc, struct bio *bio)
 {
-	daddr_t block, end;
+	u_int64_t block, end;	/* daddr_t is int32: >1TiB media truncates */
 	struct mmc_command cmd;
 	struct mmc_command stop;
 	struct mmc_request req;
@@ -337,6 +337,14 @@
 
 	block = bio->bio_offset / sz;
 	end = block + (bp->b_bcount / sz);
+	if (end > 0xFFFFFFFFULL) {
+		/* the MMC command argument is 32-bit: refuse rather than
+		 * issue a command against the wrong sector */
+		bp->b_error = EIO;
+		bp->b_flags |= B_ERROR;
+		bp->b_resid = bp->b_bcount;
+		return (block);
+	}
 	while (block < end) {
 		char *vaddr = bp->b_data +
 		    (block - (bio->bio_offset / sz)) * sz;
@@ -388,7 +396,7 @@
 static daddr_t
 mmcsd_delete(struct mmcsd_softc *sc, struct bio *bio)
 {
-	daddr_t block, end, start, stop;
+	u_int64_t block, end, start, stop;
 	struct mmc_command cmd;
 	struct mmc_request req;
 	device_t dev = sc->dev;