--- a/sys/bus/u4b/storage/umass.c
+++ b/sys/bus/u4b/storage/umass.c
@@ -2598,6 +2598,21 @@
 
 		/* fetch sense data */
 
+		/*
+		 * The autosense data is DMA'd into the fixed-size
+		 * csio.sense_data array inside the kernel CCB.  A
+		 * user-supplied CCB (pass(4) CAMIOCOMMAND) can set
+		 * csio.sense_len up to 255 while sizeof(sense_data) is
+		 * only 32 bytes.  Clamp it before it is used both as
+		 * the REQUEST SENSE allocation length and as the DMA
+		 * length, otherwise a malicious USB storage device
+		 * that answers with up to alloc-length bytes of sense
+		 * data overwrites the remainder of the ccb_scsiio
+		 * structure in kernel memory.
+		 */
+		if (ccb->csio.sense_len > sizeof(ccb->csio.sense_data))
+			ccb->csio.sense_len = sizeof(ccb->csio.sense_data);
+
 		/* the rest of the command was filled in at attach */
 		sc->cam_scsi_sense.length = ccb->csio.sense_len;