--- sys/bus/cam/scsi/scsi_ch.c
+++ sys/bus/cam/scsi/scsi_ch.c
@@ -1086,7 +1086,9 @@
 	 * that the first one can fit into 1k.
 	 */
 	cam_periph_unlock(periph);
-	data = (caddr_t)kmalloc(1024, M_DEVBUF, M_INTWAIT);
+	/* DF-5332: a short-but-GOOD transfer (resid > 0) must read back
+	 * as zeros, not as stale kernel heap. */
+	data = (caddr_t)kmalloc(1024, M_DEVBUF, M_INTWAIT | M_ZERO);
 
 	cam_periph_lock(periph);
 	ccb = cam_periph_getccb(periph, /*priority*/ 1);
@@ -1126,7 +1128,8 @@
 	 * device.
 	 */
 	kfree(data, M_DEVBUF);
-	data = (caddr_t)kmalloc(size, M_DEVBUF, M_INTWAIT);
+	/* DF-5332: as above -- un-written tail is parsed and copyout()ed. */
+	data = (caddr_t)kmalloc(size, M_DEVBUF, M_INTWAIT | M_ZERO);
 
 	cam_periph_lock(periph);
 	scsi_read_element_status(&ccb->csio,