--- a/sys/dev/raid/hptiop/hptiop.c	2026-09-17 06:16:59.056779292 +0000
+++ b/sys/dev/raid/hptiop/hptiop.c	2026-09-17 06:16:59.056779292 +0000
@@ -1932,6 +1932,14 @@ static int hptiop_attach(device_t dev)
 	hba->max_request_size = iop_config.request_size;
 	hba->max_sg_count = iop_config.max_sg_count;
 
+	/*
+	 * SG lists are written into the fixed-size srb->req[] buffer;
+	 * clamp the firmware-reported value to the real capacity.
+	 */
+	if (hba->max_sg_count == 0 ||
+	    hba->max_sg_count > HPT_SRB_MAX_SG_COUNT)
+		hba->max_sg_count = HPT_SRB_MAX_SG_COUNT;
+
 	if (hba->ops->family == MVFREY_BASED_IOP) {
 		if (hba->ops->internal_memalloc(hba)) {
 			device_printf(dev, "alloc srb_dmat failed\n");
--- a/sys/dev/raid/hptiop/hptiop.h	2026-09-17 06:16:59.056779292 +0000
+++ b/sys/dev/raid/hptiop/hptiop.h	2026-09-17 06:16:59.056779292 +0000
@@ -42,6 +42,12 @@ int hpt_iop_dbg_level = 0;
 #define HPT_SRB_MAX_REQ_SIZE                600
 #define HPT_SRB_MAX_QUEUE_SIZE              0x100
 
+/* max SG entries that fit in the fixed srb->req[HPT_SRB_MAX_REQ_SIZE] area */
+#define HPT_SRB_MAX_SG_COUNT \
+	((HPT_SRB_MAX_REQ_SIZE - \
+	offsetof(struct hpt_iop_request_scsi_command, sg_list)) / \
+	sizeof(struct hpt_iopsg))
+
 /* beyond 64G mem */
 #define HPT_SRB_FLAG_HIGH_MEM_ACESS         0x1
 #define HPT_SRB_MAX_SIZE  ((sizeof(struct hpt_iop_srb) + 0x1f) & ~0x1f)