--- a/sys/dev/disk/mpt/mpt_cam.c
+++ b/sys/dev/disk/mpt/mpt_cam.c
@@ -2646,6 +2646,11 @@ mpt_scsi_reply_handler(struct mpt_softc *mpt, request_t *req,
 	MSG_SCSI_IO_REQUEST *scsi_req;
 	union ccb *ccb;
 
+	if (req == NULL) {
+		mpt_prt(mpt, "mpt_scsi_reply_handler: NULL request\n");
+		return (TRUE);
+	}
+
 	if (req->state == REQ_STATE_FREE) {
 		mpt_prt(mpt, "mpt_scsi_reply_handler: req already free\n");
 		return (TRUE);
@@ -5201,6 +5206,12 @@ mpt_scsi_tgt_reply_handler(struct mpt_softc *mpt, request_t *req,
 	union ccb *ccb;
 	U16 status;
 
+	if (req == NULL) {
+		mpt_prt(mpt, "mpt_scsi_tgt_reply_handler: NULL request\n");
+		return (TRUE);
+	}
+
 	if (reply_frame == NULL) {
 		/*
 		 * Figure out what the state of the command is.