--- a/sys/dev/raid/mly/mly.c
+++ b/sys/dev/raid/mly/mly.c
@@ -2341,12 +2341,16 @@ mly_cam_complete(struct mly_command *mc)
 	    if (cmd == INQUIRY) {
 		btl = &sc->mly_btl[bus][target];
-		padstr(inq->vendor, mly_describe_code(mly_table_device_type, btl->mb_type), 8);
-		padstr(inq->product, mly_describe_code(mly_table_device_state, btl->mb_state), 16);
-		padstr(inq->revision, "MYLX", 4);
+		/*
+		 * Only rewrite the inquiry data if the CCB actually
+		 * carries a full scsi_inquiry_data (36 bytes).  pass(4)
+		 * lets a user pick any dxfer_len; writing at inq+8..36
+		 * past a shorter buffer is a kernel heap overflow.
+		 */
+		if (csio->dxfer_len >= 36) {
+		    padstr(inq->vendor, mly_describe_code(mly_table_device_type, btl->mb_type), 8);
+		    padstr(inq->product, mly_describe_code(mly_table_device_state, btl->mb_state), 16);
+		    padstr(inq->revision, "MYLX", 4);
+		}
 	    }
 	}