
< 	if ((mpirep_offset != 0xFF) &&
< 		drv_buf_iter = &drv_bufs[mpirep_offset];
< 		drv_buf_iter->kern_buf_len = (sizeof(*bsg_reply_buf) - 1 +
---
> 	if ((mpirep_offset != 0xFF) && (mpirep_offset < bufcnt)) {
> 		drv_buf_iter = &drv_bufs[mpirep_offset];
> 		if (drv_buf_iter && drv_buf_iter->kern_buf) {
> 			drv_buf_iter->kern_buf_len = (sizeof(*bsg_reply_buf) - 1 +
