--- a/sys/dev/raid/twa/tw_osl_freebsd.c
+++ b/sys/dev/raid/twa/tw_osl_freebsd.c
@@ -905,6 +905,15 @@ tw_osli_fw_passthru(struct twa_softc *sc, TW_INT8 *buf)
 	struct tw_cl_passthru_req_packet	*pt_req;
 	TW_INT32				error;
 
 	tw_osli_dbg_dprintf(5, sc, "ioctl: passthru");
+
+	/*
+	 * The ioctl DMA tags are capped at TW_CL_MAX_IO_SIZE (128KB);
+	 * anything larger can never be mapped (bus_dmamap_load would
+	 * fail with EFBIG only after we already allocated and copied
+	 * in the whole buffer), and lengths near 2^32 silently wrap
+	 * roundup2() below to zero.  Reject them up front.
+	 */
+	if (user_buf->driver_pkt.buffer_length > TW_CL_MAX_IO_SIZE)
+		return(E2BIG);
 
 	if ((req = tw_osli_get_request(sc)) == NULL)
 		return(EBUSY);