--- a/sys/bus/cam/scsi/scsi_pass.c
+++ b/sys/bus/cam/scsi/scsi_pass.c
@@ -452,6 +452,11 @@ passioctl(struct dev_ioctl_args *ap)
 	if (periph == NULL)
 		return(ENXIO);
 
+	/* Mirror passopen(): no CAM passthrough at high securelevel,
+	 * including on descriptors opened before the raise. */
+	if (securelevel > 1)
+		return (EPERM);
+
 	cam_periph_lock(periph);
 
 	error = 0;