--- a/sys/dev/raid/iir/iir.c +++ b/sys/dev/raid/iir/iir.c @@ -733,6 +733,14 @@ ccbh->status = CAM_REQ_INVALID; --gdt_stat.io_count_act; xpt_done(ccb); + } else if ((ccbh->flags & CAM_SCATTER_VALID) && + csio->sglist_cnt > GDT_MAXSG) { + /* physical S/G lists are copied verbatim into the fixed + GDT_MAXSG-entry array in gccb->gc_cmd -- an oversized + list overflows it */ + ccbh->status = CAM_REQ_TOO_BIG; + --gdt_stat.io_count_act; + xpt_done(ccb); } else if (bus != gdt->sc_virt_bus) { /* raw service command */ if ((gccb = gdt_raw_cmd(gdt, ccb)) == NULL) {