--- a/sys/dev/disk/mpt/mpt_cam.c +++ b/sys/dev/disk/mpt/mpt_cam.c @@ -3129,8 +3129,14 @@ mpt_scsi_reply_frame_handler(struct mpt_softc *mpt, request_t *req, sstate = scsi_io_reply->SCSIState; ccb = req->ccb; - ccb->csio.resid = - ccb->csio.dxfer_len - le32toh(scsi_io_reply->TransferCount); + { + uint32_t xferred = le32toh(scsi_io_reply->TransferCount); + + if (xferred > ccb->csio.dxfer_len) + ccb->csio.resid = 0; /* IOC over-reported */ + else + ccb->csio.resid = ccb->csio.dxfer_len - xferred; + } if ((sstate & MPI_SCSI_STATE_AUTOSENSE_VALID) != 0 && (ccb->ccb_h.flags & (CAM_SENSE_PHYS | CAM_SENSE_PTR)) == 0) {