diff --git a/sys/dev/raid/dpt/dpt_scsi.c b/sys/dev/raid/dpt/dpt_scsi.c
index ebc9e1a..7664bc1 100644
--- a/sys/dev/raid/dpt/dpt_scsi.c
+++ b/sys/dev/raid/dpt/dpt_scsi.c
@@ -646,6 +646,11 @@ dpt_detect_cache(dpt_softc_t *dpt, dpt_ccb_t *dccb, u_int32_t dccb_busaddr,
 		return;
 	}
 	bytes = DPT_HCP_LENGTH(buff);
+	/* The page header is controller-fed; only 512 bytes were actually
+	 * DMA'd (cp_datalen = htonl(512), :618).  Do not let the parameter
+	 * walk run past the transfer buffer. */
+	if (bytes > 512)
+		bytes = 512;
 	param = DPT_HCP_FIRST(buff);
 
 	if (DPT_HCP_CODE(param) != 1) {