--- /tmp/opencode/kern_physio.c.orig	2026-09-04 13:52:30.933945793 +0000
+++ sys/kern/kern_physio.c	2026-09-04 13:52:30.949945590 +0000
@@ -95,8 +95,28 @@
 			 * user buffer directly into kernel memory without
 			 * copying.
 			 */
+			/*
+			 * DF-2979: b_resid is consumed after the transfer
+			 * (iolen = b_bcount - b_resid) but is not initialized
+			 * here, nor by initpbuf(), nor by reinitbufbio().
+			 * pbufs are recycled across the whole pbuf_mem pool
+			 * (physio, cam_periph, disklabel scanners), so a
+			 * strategy completion that does not set b_resid
+			 * itself (e.g. virtio_blk error completions, xdisk
+			 * timeouts/lost links) would make iolen reflect a
+			 * previous tenant's value.
+			 */
+			bp->b_resid = 0;
 			if (uio->uio_segflg == UIO_USERSPACE) {
 				bp->b_bcount = bcount;
+				/*
+				 * DF-2979: do not disclose the previous
+				 * tenant's bounce-buffer contents if the
+				 * read errors out before any data has been
+				 * transferred.
+				 */
+				if (uio->uio_rw == UIO_READ)
+					bzero(bp->b_data, bcount);
 				if (uio->uio_rw == UIO_WRITE) {
 					error = copyin(ubase, bp->b_data, bcount);
 					if (error)