--- a/sys/dev/raid/mfi/mfi_tbolt.c
+++ b/sys/dev/raid/mfi/mfi_tbolt.c
@@ -1136,12 +1136,10 @@
 mfi_tbolt_send_frame(struct mfi_softc *sc, struct mfi_command *cm)
 {
 	struct mfi_frame_header *hdr;
-	uint8_t *cdb;
 	union mfi_mpi2_request_descriptor *req_desc = NULL;
 	int tm = MFI_POLL_TIMEOUT_SECS * 1000;
 
 	hdr = &cm->cm_frame->header;
-	cdb = cm->cm_frame->pass.cdb;
 	if (sc->adpreset)
 		return 1;
 	if ((cm->cm_flags & MFI_CMD_POLLED) == 0) {
@@ -1154,17 +1152,17 @@
 	}
 
 	if (hdr->cmd == MFI_CMD_PD_SCSI_IO) {
-		/* check for inquiry commands coming from CLI */
-		if (cdb[0] != 0x28 && cdb[0] != 0x2A) {
-			if ((req_desc = mfi_tbolt_build_mpt_cmd(sc, cm)) ==
-			    NULL) {
-				device_printf(sc->mfi_dev, "Mapping from MFI "
-				    "to MPT Failed \n");
-				return 1;
-			}
+		/*
+		 * All PD passthru commands, including READ_10/WRITE_10
+		 * (system-PD bios, crash dumps), must go through the MPT
+		 * frame build.  Falling through with req_desc == NULL used
+		 * to dereference NULL when the request was posted below.
+		 */
+		if ((req_desc = mfi_tbolt_build_mpt_cmd(sc, cm)) == NULL) {
+			device_printf(sc->mfi_dev, "Mapping from MFI "
+			    "to MPT Failed \n");
+			return 1;
 		}
-		else
-			device_printf(sc->mfi_dev, "DJA NA XXX SYSPDIO\n");
 	}
 	else if (hdr->cmd == MFI_CMD_LD_SCSI_IO ||
 	    hdr->cmd == MFI_CMD_LD_READ || hdr->cmd == MFI_CMD_LD_WRITE) {