--- a/sys/bus/cam/scsi/scsi_cd.c	2026-10-01 22:57:28.582365539 +0000
+++ b/sys/bus/cam/scsi/scsi_cd.c	2026-10-01 22:57:28.594365386 +0000
@@ -2138,8 +2138,10 @@
 			struct cd_sub_channel_info *data;
 			u_int32_t len = args->data_len;
 
+			/* M_ZERO: a short device transfer must not
+			 * disclose uninitialized kernel heap. */
 			data = kmalloc(sizeof(struct cd_sub_channel_info),
-				      M_SCSICD, M_WAITOK);
+				      M_SCSICD, M_WAITOK | M_ZERO);
 
 			cam_periph_lock(periph);
 			CAM_DEBUG(periph->path, CAM_DEBUG_SUBTRACE,