
<     if ((mpirep_offset != 0xFF) &&
<         drv_buf_iter = &drv_bufs[mpirep_offset];
<         drv_buf_iter->kern_buf_len = (sizeof(*bsg_reply_buf) - 1 +
---
>     if ((mpirep_offset != 0xFF) && (mpirep_offset < bufcnt)) {
>         drv_buf_iter = &drv_bufs[mpirep_offset];
>         drv_buf_iter->kern_buf_len = (sizeof(*bsg_reply_buf) - 1 +
