--- /home/maxx/dfbsd/dfbsd/sys/dev/raid/aac/aac.c	2026-07-22 16:41:59.460308436 +0000
+++ /tmp/opencode/fix/aac.c	2026-09-16 10:59:46.452872293 +0000
@@ -1806,8 +1806,15 @@
 		options = AAC_GET_MAILBOX(sc, 3);
 		sc->aac_max_fibs = (options & 0xFFFF);
 	}
-	if (sc->aac_max_fib_size > PAGE_SIZE)
-		sc->aac_max_fib_size = PAGE_SIZE;
+	/*
+	 * The adapter reports this geometry; a zero or sub-header value
+	 * would divide by zero below and would make the 28-byte header
+	 * copyin() in aac_ioctl_sendfib() overflow the undersized FIB
+	 * slots.  Clamp to a sane floor.
+	 */
+	if ((sc->aac_max_fib_size < sizeof(struct aac_fib))
+	 || (sc->aac_max_fib_size > PAGE_SIZE))
+		sc->aac_max_fib_size = sizeof(struct aac_fib);
 	sc->aac_max_fibs_alloc = PAGE_SIZE / sc->aac_max_fib_size;
 
 	if (sc->aac_max_fib_size > sizeof(struct aac_fib)) {