--- /home/maxx/dfbsd/dfbsd/sys/dev/raid/asr/asr.c	2026-06-29 12:51:19.000000000 +0000
+++ /tmp/opencode/fix/asr.c	2026-09-16 10:59:46.456872246 +0000
@@ -1809,8 +1809,16 @@
 	MessageSize = I2O_MESSAGE_FRAME_getMessageSize(Message_Ptr);
 	PRIVATE_SCSI_SCB_EXECUTE_MESSAGE_setByteCount(
 	  (PPRIVATE_SCSI_SCB_EXECUTE_MESSAGE)Message_Ptr, len);
+	/*
+	 * The mandatory sense element written after this loop must stay
+	 * inside asr_action()'s MAX_INBOUND_SIZE (512-byte) stack buffer:
+	 * with the header at offset 48 and 8-byte elements, loop element
+	 * [57] ends exactly at 512, so reserve one slot for the sense
+	 * element (and never exceed the adapter's own SG limit).
+	 */
 	while ((len > 0) && (sg < &((PPRIVATE_SCSI_SCB_EXECUTE_MESSAGE)
-	  Message_Ptr)->SGL.u.Simple[SG_SIZE])) {
+	  Message_Ptr)->SGL.u.Simple[SG_SIZE - 1]))
+	{
 		span = 0;
 		next = base = KVTOPHYS(v);
 		I2O_SGE_SIMPLE_ELEMENT_setPhysicalAddress(sg, base);