--- a/sys/dev/disk/nata/atapi-fd.c	2026-09-24 17:15:01.460690390 +0000
+++ b/sys/dev/disk/nata/atapi-fd.c	2026-09-24 17:15:47.644089923 +0000
@@ -255,6 +255,20 @@
 	return 0;
     }
 
+    /*
+     * The raw cdev path never bounds-checks bio_offset against the media
+     * size (bounds_check_with_mediasize() is only used by dm), and the
+     * CDB LBA below is only 32 bits wide — I/O past 2^32 sectors would
+     * silently wrap onto low LBAs.  Reject anything beyond the media.
+     * (DF-4877)
+     */
+    if (fdp->mediasize == 0 ||
+	bp->bio_offset >= fdp->mediasize ||
+	bp->bio_offset + (u_int64_t)bbp->b_bcount > fdp->mediasize) {
+	biofinish(bp, NULL, EINVAL);
+	return 0;
+    }
+
     lba = bp->bio_offset / fdp->sectorsize;
     count = bbp->b_bcount / fdp->sectorsize;
     bbp->b_resid = bbp->b_bcount;