problem with mpt driver. anyone seen this or similar? (10.3)

Does this ring any bells?
even a theory would be a big improvement.

memcpy+0xc
mpt_read_cfg_page+0xcc
mpt_cation+0x148e
xpt_action_default+0x7e
cam_periph_runccb+0x7c
passdoioctl+0x719
passioctl+0x30
devfs_ioctl_f+0x7c
kern_ioctl+0x1a8
sys_ioctl+0x11f
amd64_syscall+0x3f9
xfast_syscall+0xf7

we see a memory access fault at line 1821..

1786 int
1787 mpt_read_cfg_page(struct mpt_softc *mpt, int Action, uint32_t PageAddress,
1788                   CONFIG_PAGE_HEADER *hdr, size_t len, int sleep_ok,
1789                   int timeout_ms)
1790 {
1791         request_t    *req;
1792         cfgparms_t    params;
1793         int           error;
1794
1795         req = mpt_get_request(mpt, sleep_ok);
1796         if (req == NULL) {
1797                 mpt_prt(mpt, "mpt_read_cfg_page: Get request failed!\n");
1798                 return (-1);
1799         }
1800
1801         params.Action = Action;
1802         params.PageVersion = hdr->PageVersion;
1803         params.PageLength = hdr->PageLength;
1804         params.PageNumber = hdr->PageNumber;
1805         params.PageType = hdr->PageType & MPI_CONFIG_PAGETYPE_MASK;
1806         params.PageAddress = PageAddress;
1807         error = mpt_issue_cfg_req(mpt, req, &params,
1808                                   req->req_pbuf + MPT_RQSL(mpt),
1809                                   len, sleep_ok, timeout_ms);
1810         if (error != 0) {
1811                 mpt_prt(mpt, "read_cfg_page(%d) timed out\n", Action);
1812                 return (-1);
1813         }
1814
1815         if ((req->IOCStatus & MPI_IOCSTATUS_MASK) != MPI_IOCSTATUS_SUCCESS) {
1816                 mpt_prt(mpt, "mpt_read_cfg_page: Config Info Status %x\n",
1817                         req->IOCStatus);
1818                 mpt_free_request(mpt, req);
1819                 return (-1);
1820         }
1821         memcpy(hdr, ((uint8_t *)req->req_vbuf)+MPT_RQSL(mpt), len);   <------
1822         mpt_free_request(mpt, req);
1823         return (0);
1824 }
1825
1826 int
1827 mpt_write_cfg_page(struct mpt_softc *mpt, int Action, uint32_t PageAddress,
"mpt/mpt.c" [readonly] 3146 lines --58%--