diff --git a/sys/kern/uipc_ktls.c b/sys/kern/uipc_ktls.c
--- a/sys/kern/uipc_ktls.c
+++ b/sys/kern/uipc_ktls.c
@@ -1981,14 +1981,16 @@
 	counter_u64_add(ktls_cnt_tx_queued, 1);
 }
 
+#define	MAX_TLS_PAGES	(1 + btoc(TLS_MAX_MSG_SIZE_V10_2))
+
 static __noinline void
 ktls_encrypt(struct ktls_wq *wq, struct mbuf *top)
 {
 	struct ktls_session *tls;
 	struct socket *so;
 	struct mbuf *m;
-	vm_paddr_t parray[1 + btoc(TLS_MAX_MSG_SIZE_V10_2)];
-	struct iovec dst_iov[1 + btoc(TLS_MAX_MSG_SIZE_V10_2)];
+	vm_paddr_t parray[MAX_TLS_PAGES + 1];
+	struct iovec dst_iov[MAX_TLS_PAGES + 2];
 	vm_page_t pg;
 	void *cbuf;
 	int error, i, len, npages, off, total_pages;
@@ -2072,8 +2074,12 @@
 					dst_iov[i].iov_len = len;
 				}
 			}
+			KASSERT(i + 1 <= nitems(dst_iov),
+			    ("dst_iov is too small"));
+			dst_iov[i].iov_base = m->m_epg_trail;
+			dst_iov[i].iov_len = m->m_epg_trllen;
 
-			error = (*tls->sw_encrypt)(tls, m, dst_iov, i);
+			error = (*tls->sw_encrypt)(tls, m, dst_iov, i + 1);
 
 			/* Free the old pages. */
 			m->m_ext.ext_free(m);
diff --git a/sys/opencrypto/ktls_ocf.c b/sys/opencrypto/ktls_ocf.c
--- a/sys/opencrypto/ktls_ocf.c
+++ b/sys/opencrypto/ktls_ocf.c
@@ -286,13 +286,8 @@
 		memcpy(crp.crp_iv, hdr + 1, AES_BLOCK_LEN);
 
 	if (outiov != NULL) {
-		/* Duplicate iovec and append vector for trailer. */
-		memcpy(iov, outiov, outiovcnt * sizeof(struct iovec));
-		iov[outiovcnt].iov_base = m->m_epg_trail;
-		iov[outiovcnt].iov_len = m->m_epg_trllen;
-
-		uio.uio_iov = iov;
-		uio.uio_iovcnt = outiovcnt + 1;
+		uio.uio_iov = outiov;
+		uio.uio_iovcnt = outiovcnt;
 		uio.uio_offset = 0;
 		uio.uio_segflg = UIO_SYSSPACE;
 		uio.uio_td = curthread;
@@ -336,7 +331,6 @@
 	struct tls_aead_data ad;
 	struct cryptop crp;
 	struct ocf_session *os;
-	struct iovec iov[outiovcnt + 1];
 	int error;
 	uint16_t tls_comp_len;
 
@@ -376,14 +370,10 @@
 	crp.crp_payload_length = tls_comp_len;
 
 	if (outiov != NULL) {
-		/* Duplicate iovec and append vector for tag. */
-		memcpy(iov, outiov, outiovcnt * sizeof(struct iovec));
-		iov[outiovcnt].iov_base = m->m_epg_trail;
-		iov[outiovcnt].iov_len = tls->params.tls_tlen;
 		crp.crp_digest_start = crp.crp_payload_length;
 
-		uio.uio_iov = iov;
-		uio.uio_iovcnt = outiovcnt + 1;
+		uio.uio_iov = outiov;
+		uio.uio_iovcnt = outiovcnt;
 		uio.uio_offset = 0;
 		uio.uio_segflg = UIO_SYSSPACE;
 		uio.uio_td = curthread;
@@ -486,7 +476,6 @@
 	char nonce[12];
 	struct cryptop crp;
 	struct ocf_session *os;
-	struct iovec iov[outiovcnt + 1];
 	int error;
 
 	os = tls->cipher;
@@ -516,14 +505,10 @@
 	crp.crp_payload_length++;
 
 	if (outiov != NULL) {
-		/* Duplicate iovec and append vector for tag. */
-		memcpy(iov, outiov, outiovcnt * sizeof(struct iovec));
-		iov[outiovcnt].iov_base = m->m_epg_trail;
-		iov[outiovcnt].iov_len = tls->params.tls_tlen;
 		crp.crp_digest_start = crp.crp_payload_length;
 
-		uio.uio_iov = iov;
-		uio.uio_iovcnt = outiovcnt + 1;
+		uio.uio_iov = outiov;
+		uio.uio_iovcnt = outiovcnt;
 		uio.uio_offset = 0;
 		uio.uio_segflg = UIO_SYSSPACE;
 		uio.uio_td = curthread;