--- /home/maxx/dfbsd/dfbsd/sys/dev/raid/asr/asr.c	2026-06-29 12:51:19.000000000 +0000
+++ /tmp/opencode/fix/asr.c	2026-09-16 10:59:46.456872246 +0000
@@ -2887,6 +2887,21 @@
 		 && ((ReplyOffset = asr_get_FromFIFO(sc)) == EMPTY_QUEUE)) {
 			break;
 		}
+		/*
+		 * The FromFIFO value comes from the adapter.  Never map an
+		 * offset outside the ha_Msgs reply-frame pool into a kernel
+		 * pointer: a broken or hostile IOP would steer every later
+		 * deref (InitiatorContext64 -> ccb -> ASR_ccbRemove) at
+		 * arbitrary kernel memory.
+		 */
+		if ((ReplyOffset < sc->ha_Msgs_Phys)
+		 || (ReplyOffset >= sc->ha_Msgs_Phys + (u_int32_t)
+		      ((U32)sc->ha_Msgs_Count
+		       * sizeof(I2O_SCSI_ERROR_REPLY_MESSAGE_FRAME)))) {
+			kprintf("asr%d: bogus reply frame offset 0x%x\n",
+			  0, ReplyOffset);
+			break;
+		}
 		Reply = (PI2O_SCSI_ERROR_REPLY_MESSAGE_FRAME)(ReplyOffset
 		  - sc->ha_Msgs_Phys + (char *)(sc->ha_Msgs));
 		/*