diff --git a/sys/cam/ctl/scsi_ctl.c b/sys/cam/ctl/scsi_ctl.c
--- a/sys/cam/ctl/scsi_ctl.c
+++ b/sys/cam/ctl/scsi_ctl.c
@@ -479,6 +479,7 @@
 		    /*getcount_only*/1);
 	}
 
+	memset(&ccb, 0, sizeof(ccb));
 	xpt_setup_ccb(&ccb.ccb_h, periph->path, CAM_PRIORITY_NONE);
 	ccb.ccb_h.func_code = XPT_EN_LUN;
 	ccb.cel.grp6_len = 0;
@@ -613,6 +614,7 @@
 	cam_status status;
 
 	/* Abort all ATIOs and INOTs queued to SIM. */
+	memset(&ccb, 0, sizeof(ccb));
 	xpt_setup_ccb(&ccb.ccb_h, periph->path, CAM_PRIORITY_NONE);
 	ccb.ccb_h.func_code = XPT_ABORT;
 	LIST_FOREACH(hdr, &softc->atio_list, periph_links.le) {
@@ -1852,6 +1854,7 @@
 	struct ccb_getdevstats cgds;
 	int num_items;
 
+	memset(&cgds, 0, sizeof(cgds));
 	xpt_setup_ccb(&cgds.ccb_h, periph->path, CAM_PRIORITY_NORMAL);
 	cgds.ccb_h.func_code = XPT_GDEV_STATS;
 	xpt_action((union ccb *)&cgds);
diff --git a/sys/cam/scsi/scsi_targ_bh.c b/sys/cam/scsi/scsi_targ_bh.c
--- a/sys/cam/scsi/scsi_targ_bh.c
+++ b/sys/cam/scsi/scsi_targ_bh.c
@@ -241,6 +241,7 @@
 	if ((softc->flags & TARGBH_FLAG_LUN_ENABLED) != 0)
 		return (CAM_REQ_CMP);
 
+	memset(&immed_ccb, 0, sizeof(immed_ccb));
 	xpt_setup_ccb(&immed_ccb.ccb_h, periph->path, CAM_PRIORITY_NORMAL);
 	immed_ccb.ccb_h.func_code = XPT_EN_LUN;
 
@@ -267,7 +268,7 @@
 		struct ccb_accept_tio *atio;
 
 		atio = (struct ccb_accept_tio*)malloc(sizeof(*atio), M_SCSIBH,
-						      M_NOWAIT);
+						      M_ZERO | M_NOWAIT);
 		if (atio == NULL) {
 			status = CAM_RESRC_UNAVAIL;
 			break;
@@ -309,7 +310,7 @@
 		struct ccb_immediate_notify *inot;
 
 		inot = (struct ccb_immediate_notify*)malloc(sizeof(*inot),
-			    M_SCSIBH, M_NOWAIT);
+			    M_SCSIBH, M_ZERO | M_NOWAIT);
 
 		if (inot == NULL) {
 			status = CAM_RESRC_UNAVAIL;
@@ -350,6 +351,8 @@
 	if ((softc->flags & TARGBH_FLAG_LUN_ENABLED) == 0)
 		return CAM_REQ_CMP;
 
+	memset(&ccb, 0, sizeof(ccb));
+
 	/* XXX Block for Continue I/O completion */
 
 	/* Kill off all ACCECPT and IMMEDIATE CCBs */
diff --git a/sys/cam/scsi/scsi_target.c b/sys/cam/scsi/scsi_target.c
--- a/sys/cam/scsi/scsi_target.c
+++ b/sys/cam/scsi/scsi_target.c
@@ -363,6 +363,7 @@
 	cam_status	  status;
 
 	/* Tell the lun to begin answering selects */
+	memset(&en_ccb, 0, sizeof(en_ccb));
 	xpt_setup_ccb(&en_ccb.ccb_h, path, CAM_PRIORITY_NORMAL);
 	en_ccb.ccb_h.func_code = XPT_EN_LUN;
 	/* Don't need support for any vendor specific commands */
@@ -936,7 +937,7 @@
 	int ccb_len;
 
 	ccb_len = targccblen(type);
-	ccb = malloc(ccb_len, M_TARG, M_NOWAIT);
+	ccb = malloc(ccb_len, M_TARG, M_NOWAIT | M_ZERO);
 	CAM_DEBUG(softc->path, CAM_DEBUG_PERIPH, ("getccb %p\n", ccb));
 	if (ccb == NULL) {
 		return (ccb);
@@ -1033,6 +1034,7 @@
 	 * Then abort all pending CCBs.
 	 * targdone() will return the aborted CCB via user_ccb_queue
 	 */
+	memset(&cab, 0, sizeof(cab));
 	xpt_setup_ccb(&cab.ccb_h, softc->path, CAM_PRIORITY_NORMAL);
 	cab.ccb_h.func_code = XPT_ABORT;
 	cab.ccb_h.status = CAM_REQ_CMP_ERR;