
<     if ((mpirep_offset != 0xFF) &&
<         drv_buf_iter = &drv_bufs[mpirep_offset];
<         drv_buf_iter->kern_buf_len = (sizeof(*bsg_reply_buf) - 1 +
---
>     if ((mpirep_offset != 0xFF) && (mpirep_offset < bufcnt)) {
>         size_t new_len = (sizeof(*bsg_reply_buf) - 1 +
>                           mrioc->bsg_cmds.ioc_status_sz);
>         if (new_len <= drv_bufs[mpirep_offset].bsg_buf_len) {
>             drv_buf_iter = &drv_bufs[mpirep_offset];
>             drv_buf_iter->kern_buf_len = new_len;
>         }
