diff -u -p -r /tmp/opencode/fix/p3843_base/raid/mrsas.c /tmp/opencode/fix/p3843_mod/raid/mrsas.c
--- a/sys/dev/raid/mrsas/mrsas.c	2026-09-16 14:47:26.416998007 +0000
+++ b/sys/dev/raid/mrsas/mrsas.c	2026-09-16 14:47:26.416998007 +0000
@@ -3205,7 +3205,21 @@ static int mrsas_sync_map_info(struct mr
 
     map = sc->raidmap_mem[sc->map_id & 1];
     num_lds = map->raidMap.ldCount;
-    
+
+    /*
+     * DF-3843: ldCount is firmware-controlled and was previously
+     * unbounded.  The loop below writes num_lds *
+     * sizeof(MR_LD_TARGET_SYNC) bytes into a map_sz-sized buffer;
+     * reject absurd counts before writing anything.
+     */
+    if (num_lds > MAX_LOGICAL_DRIVES) {
+        device_printf(sc->mrsas_dev,
+            "raid map ldCount %u > %d, skipping map sync\n",
+            num_lds, MAX_LOGICAL_DRIVES);
+        mrsas_release_mfi_cmd(cmd);
+        return 1;
+    }
+
     dcmd = &cmd->frame->dcmd;
     size_sync_info = sizeof(MR_LD_TARGET_SYNC) * num_lds;
     memset(dcmd->mbox.b, 0, MFI_MBOX_SIZE);
diff -u -p -r /tmp/opencode/fix/p3843_base/raid/mrsas_fp.c /tmp/opencode/fix/p3843_mod/raid/mrsas_fp.c
--- a/sys/dev/raid/mrsas/mrsas_fp.c	2026-09-16 14:47:26.416998007 +0000
+++ b/sys/dev/raid/mrsas/mrsas_fp.c	2026-09-16 14:47:26.440997705 +0000
@@ -264,6 +264,17 @@ u_int8_t MR_ValidateMapInfo(struct mrsas
         return 1;
     }
 
+    /*
+     * DF-3843: both sides of the size check above are firmware-supplied,
+     * so a size-consistent map can still carry an absurd ldCount.  Bound
+     * it before the map is used for fast-path IO or the sync loop.
+     */
+    if (pFwRaidMap->ldCount > MAX_LOGICAL_DRIVES) {
+        device_printf(sc->mrsas_dev, "raid map ldCount %u exceeds max %d\n",
+            pFwRaidMap->ldCount, MAX_LOGICAL_DRIVES);
+        return 1;
+    }
+
     if (sc->UnevenSpanSupport) {
         mr_update_span_set(map, ldSpanInfo);
 	}