--- a/sys/dev/raid/mfi/mfi.c
+++ b/sys/dev/raid/mfi/mfi.c
@@ -2947,6 +2947,7 @@ mfi_ioctl(struct dev_ioctl_args *ap)
 	case MFI_CMD:
 		{
 		devclass_t devclass;
-		ioc = (struct mfi_ioc_packet *)arg;
+		struct mfi_ioc_packet k_ioc;
 		int adapter;
 
+		error = copyin(arg, &k_ioc, sizeof(k_ioc));
+		if (error)
+			return (error);
+		ioc = &k_ioc;
 		adapter = ioc->mfi_adapter_no;
@@ -3090,8 +3091,10 @@ mfi_ioctl(struct dev_ioctl_args *ap)
 		}
 		ioc->mfi_frame.hdr.cmd_status = cm->cm_frame->header.cmd_status;
+		error = copyout(&k_ioc, arg, sizeof(k_ioc));
 out:
 		mfi_config_unlock(sc, locked);
-		... (the copyout returns the modified frame; copyin'ed SGL
-		     iov_base/iov_len are then used only through copyin/copyout
-		     with per-IO length accounting — see DF-1258)
+		if (error == 0)
+			error = copyout(&k_ioc, arg, sizeof(k_ioc));
 		kfree(data, M_MFIBUF);
NOTE: the same copyin-first conversion is required for MFIIO_STATS,
MFIIO_QUERY_DISK, MFI_SET_AEN and mfi_user_command (MFIIO_PASSTHRU).