The type of cmd->frame is mfi_frame. So it should be able to
hold the whole mfi_io_frame, including union mfi_sgl sgl.
But only frame_size bytes are allocated, which is enough to
store union mfi_sgl sgl only.

Signed-off-by: Dmitry Frolov <frolov@swemel.ru>
---
 hw/scsi/megasas.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index 9e712721f8..0ddd11ccda 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -488,7 +488,7 @@ static MegasasCmd *megasas_enqueue_frame(MegasasState *s,
 {
     PCIDevice *pcid = PCI_DEVICE(s);
     MegasasCmd *cmd = NULL;
-    int frame_size = MEGASAS_MAX_SGE * sizeof(union mfi_sgl);
+    int frame_size = MEGASAS_MAX_SGE * sizeof(union mfi_sgl) + MFI_FRAME_SIZE;
     hwaddr frame_size_p = frame_size;
     unsigned long index;
 
-- 
2.34.1