DF-3817 / fix.diff
--- a/sys/dev/raid/mpr/mpr.c +++ b/sys/dev/raid/mpr/mpr.c @@ -2062,8 +2062,14 @@ case MPI2_EVENT_LOG_DATA: mpr_dprint(sc, MPR_EVENT, "MPI2_EVENT_LOG_DATA:\n"); if (sc->mpr_debug & MPR_EVENT) - hexdump(event->EventData, event->EventDataLength, NULL, - 0); + /* EventDataLength counts 32-bit words and is + * device-supplied; clamp to the bytes actually + * present in the reply frame. */ + hexdump(event->EventData, + imin(le16toh(event->EventDataLength) * 4, + sc->replyframesz - offsetof( + MPI2_EVENT_NOTIFICATION_REPLY, EventData)), + NULL, 0); break; case MPI2_EVENT_LOG_ENTRY_ADDED: entry = (MPI2_EVENT_DATA_LOG_ENTRY_ADDED *)event->EventData; |