--- a/sys/dev/raid/mfi/mfi.c
+++ b/sys/dev/raid/mfi/mfi.c
@@ -2681,8 +2681,14 @@ mfi_check_for_sscd(struct mfi_softc *sc, struct mfi_command *cm)
 	struct mfi_config_data *conf_data = cm->cm_data;
 	struct mfi_command *ld_cm = NULL;
 	struct mfi_ld_info *ld_info = NULL;
 	int error = 0;
+	size_t need = offsetof(struct mfi_config_data, ld) +
+	    sizeof(conf_data->ld[0]);
 
-	if ((cm->cm_frame->dcmd.opcode == MFI_DCMD_CFG_ADD) &&
+	if ((cm->cm_frame->dcmd.opcode == MFI_DCMD_CFG_ADD) &&
+	    conf_data != NULL &&
+	    cm->cm_len >= need &&
 	    (conf_data->ld[0].params.isSSCD == 1)) {
 		error = 1;