--- /home/maxx/dfbsd/dfbsd/sys/dev/disk/nata/atapi-cam.c	2026-07-21 05:55:38.433614773 +0000
+++ /tmp/opencode/fixtree/sys/dev/disk/nata/atapi-cam.c	2026-10-24 09:40:47.000553627 +0000
@@ -428,6 +428,11 @@
     case XPT_RESET_DEV: {
 	int tid = ccb_h->target_id;
 
+	if (tid < 0 || tid >= 2 || softc->atadev[tid] == NULL) {
+	    ccb->ccb_h.status = CAM_DEV_NOT_THERE;
+	    xpt_done(ccb);
+	    return;
+	}
 	CAM_DEBUG(ccb->ccb_h.path, CAM_DEBUG_SUBTRACE, ("dev reset\n"));
 	ata_controlcmd(softc->atadev[tid]->dev, ATA_DEVICE_RESET, 0, 0, 0);
 	ccb->ccb_h.status = CAM_REQ_CMP;
@@ -559,6 +564,12 @@
 
 	len = csio->dxfer_len;
 	buf = csio->data_ptr;
+	if (csio->dxfer_len > 0x7fffffffU) {
+	    /* dxfer_len (u_int32) does not fit int: refuse instead of
+	     * sign-extending it into the bzero()/kmalloc()/bcopy() below */
+	    ccb->ccb_h.status = CAM_REQ_INVALID;
+	    goto action_invalid;
+	}
 
 	/* some SCSI commands require special processing */
 	switch (request->u.atapi.ccb[0]) {