--- a/sys/bus/firewire/fwmem.c
+++ b/sys/bus/firewire/fwmem.c
@@ -194,7 +200,10 @@
 	struct fw_xfer *xfer;
 	struct fw_pkt *fp;
 	
-	xfer = fwmem_xfer_req(fwdev, sc, spd, 0, roundup2(len, 4), hand);
+	/* DF-5547: recv.payload is exactly len bytes (bp->b_data of
+	 * b_bcount == len); do not advertise a quadlet-padded receive
+	 * length, fw_rcv_copy() would honor it and write past the end. */
+	xfer = fwmem_xfer_req(fwdev, sc, spd, 0, len, hand);
 	if (xfer == NULL)
 		return NULL;