
<     if ((mpirep_offset != 0xFF) &&
<         drv_buf_iter = &drv_bufs[mpirep_offset];
<         drv_buf_iter->kern_buf_len = (sizeof(*bsg_reply_buf) - 1 +
---
>     if ((mpirep_offset != 0xFF)) {
>         if (mpirep_offset >= bufcnt) {
>             return -EINVAL;
>         }
>         drv_buf_iter = &drv_bufs[mpirep_offset];
>         drv_buf_iter->kern_buf_len = (sizeof(*bsg_reply_buf) - 1 +
