--- a/sys/bus/cam/scsi/scsi_target.c
+++ b/sys/bus/cam/scsi/scsi_target.c
@@ -582,6 +582,27 @@
 			break;
 		}
 		func_code = fuword32(&user_ccb->ccb_h.func_code);
+		/*
+		 * Only target-mode function codes may be injected through
+		 * this device.  Anything else must never be forwarded to
+		 * xpt_action(): queued initiator opcodes (e.g. XPT_SCSI_IO,
+		 * XPT_SCAN_LUN) complete into targdone(), which panics on
+		 * the default case, and several opcodes carry raw kernel
+		 * pointers (cdb_io.cdb_ptr, data_ptr) that this driver
+		 * never maps.
+		 */
+		switch (func_code) {
+		case XPT_ACCEPT_TARGET_IO:
+		case XPT_IMMED_NOTIFY:
+		case XPT_CONT_TARGET_IO:
+		case XPT_ABORT:
+			break;
+		default:
+			error = EINVAL;
+			break;
+		}
+		if (error != 0)
+			break;
 		switch (func_code) {
 		case XPT_ACCEPT_TARGET_IO:
 		case XPT_IMMED_NOTIFY: