--- /home/maxx/dfbsd/dfbsd/sys/dev/disk/trm/trm.c	2026-07-20 04:32:35.551908276 +0000
+++ /tmp/opencode/fixtree/sys/dev/disk/trm/trm.c	2026-10-24 09:23:04.634129308 +0000
@@ -3274,7 +3274,7 @@
 {
 	u_int16_t	*wpEeprom;
 	u_int16_t	wAddr, wCheckSum;
-	u_long	dAddr, *dpEeprom;
+	u_int32_t dAddr, *dpEeprom;	/* NVRAM schema is 32-bit words */
 
 	NVRAM_trm_read_all(pEEpromBuf,pACB);
 	wCheckSum = 0;
@@ -3311,8 +3311,10 @@
 		/* NvramMaxTag,NvramDelayTime,NvramChannelCfg,NvramScsiId */
 		*dpEeprom++ = 0x00000015;
 		/* NvramReserved1,NvramBootLun,NvramBootTarget,NvramReserved0 */
-		for (dAddr = 0; dAddr < 12; dAddr++, dpEeprom++)
-			*dpEeprom = 0x00;
+		for (dAddr = 0; dAddr < 11; dAddr++, dpEeprom++)
+			*dpEeprom = 0x00;	/* Reserved[] is 11 words; the
+						 * u16 checksum word is written
+						 * by wpEeprom below */
 		pEEpromBuf->NvramCheckSum = 0x00;
 		for (wAddr = 0, wCheckSum = 0, wpEeprom = (u_int16_t *) pEEpromBuf;
 		    wAddr < 63; wAddr++, wpEeprom++)
@@ -3693,6 +3695,10 @@
 {
 	PACB pACB = device_get_softc(dev);
 
+	/* stop the interrupt BEFORE releasing/freeing anything
+	 * trm_Interrupt touches (sense_buffers, pFreeSRB, pActiveDCB) */
+	bus_teardown_intr(dev, pACB->irq, pACB->ih);
+
 	bus_release_resource(dev, SYS_RES_IOPORT, PCIR_BAR(0), pACB->iores);
 	trm_destroySRB(pACB);
 	bus_dma_tag_destroy(pACB->sg_dmat);
@@ -3707,7 +3713,6 @@
 	bus_dmamap_destroy(pACB->sense_dmat, pACB->sense_dmamap);
 	bus_dma_tag_destroy(pACB->sense_dmat);
 	bus_dma_tag_destroy(pACB->buffer_dmat);
-	bus_teardown_intr(dev, pACB->irq, pACB->ih);
 	bus_release_resource(dev, SYS_RES_IRQ, 0, pACB->irq);
 	xpt_async(AC_LOST_DEVICE, pACB->ppath, NULL);
 	xpt_free_path(pACB->ppath);