diff --git a/sys/dev/raid/mps/mps_sas.c b/sys/dev/raid/mps/mps_sas.c
index 1111111..2222222 100644
--- a/sys/dev/raid/mps/mps_sas.c
+++ b/sys/dev/raid/mps/mps_sas.c
@@ -1940,7 +1940,12 @@ mpssas_scsiio_complete(struct mps_softc *sc, struct mps_command *cm)
 
 	switch (rep->IOCStatus & MPI2_IOCSTATUS_MASK) {
 	case MPI2_IOCSTATUS_SCSI_DATA_UNDERRUN:
-		csio->resid = cm->cm_length - rep->TransferCount;
+		/* DF-3896: TransferCount is IOC-supplied; clamp so a
+		 * bogus count cannot wrap resid to ~UINT_MAX. */
+		if (rep->TransferCount < cm->cm_length)
+			csio->resid = cm->cm_length - rep->TransferCount;
+		else
+			csio->resid = 0;
 		/* FALLTHROUGH */
 	case MPI2_IOCSTATUS_SUCCESS:
 	case MPI2_IOCSTATUS_SCSI_RECOVERED_ERROR: