Index: sys/cam/ctl/ctl_frontend_iscsi.c
===================================================================
--- sys/cam/ctl/ctl_frontend_iscsi.c
+++ sys/cam/ctl/ctl_frontend_iscsi.c
@@ -2447,6 +2447,7 @@
 	struct iscsi_bhs_data_in *bhsdi;
 	struct ctl_sg_entry ctl_sg_entry, *ctl_sglist;
 	size_t len, expected_len, sg_len, buffer_offset;
+	size_t max_send_data_segment_length;
 	const char *sg_addr;
 	icl_pdu_cb cb;
 	int ctl_sg_count, error, i;
@@ -2504,6 +2505,11 @@
 	sg_len = 0;
 	response = NULL;
 	bhsdi = NULL;
+	if (cs->cs_conn->ic_hw_isomax != 0)
+		max_send_data_segment_length = cs->cs_conn->ic_hw_isomax;
+	else
+		max_send_data_segment_length =
+		    cs->cs_conn->ic_max_send_data_segment_length;
 	for (;;) {
 		if (response == NULL) {
 			response = cfiscsi_pdu_new_response(request, M_NOWAIT);
@@ -2520,7 +2526,7 @@
 			bhsdi->bhsdi_initiator_task_tag =
 			    bhssc->bhssc_initiator_task_tag;
 			bhsdi->bhsdi_target_transfer_tag = 0xffffffff;
-			bhsdi->bhsdi_datasn = htonl(PRIV_EXPDATASN(io)++);
+			bhsdi->bhsdi_datasn = htonl(PRIV_EXPDATASN(io));
 			bhsdi->bhsdi_buffer_offset = htonl(buffer_offset);
 		}
 
@@ -2536,15 +2542,11 @@
 		/*
 		 * Truncate to maximum data segment length.
 		 */
-		KASSERT(response->ip_data_len <
-		    cs->cs_conn->ic_max_send_data_segment_length,
-		    ("ip_data_len %zd >= max_send_data_segment_length %d",
-		    response->ip_data_len,
-		    cs->cs_conn->ic_max_send_data_segment_length));
-		if (response->ip_data_len + len >
-		    cs->cs_conn->ic_max_send_data_segment_length) {
-			len = cs->cs_conn->ic_max_send_data_segment_length -
-			    response->ip_data_len;
+		KASSERT(response->ip_data_len < max_send_data_segment_length,
+		    ("ip_data_len %zd >= max_send_data_segment_length %zd",
+		    response->ip_data_len, max_send_data_segment_length));
+		if (response->ip_data_len + len > max_send_data_segment_length) {
+			len = max_send_data_segment_length - response->ip_data_len;
 			KASSERT(len <= sg_len, ("len %zd > sg_len %zd",
 			    len, sg_len));
 		}
@@ -2603,8 +2605,7 @@
 			i++;
 		}
 
-		if (response->ip_data_len ==
-		    cs->cs_conn->ic_max_send_data_segment_length) {
+		if (response->ip_data_len == max_send_data_segment_length) {
 			/*
 			 * Can't stuff more data into the current PDU;
 			 * queue it.  Note that's not enough to check
@@ -2619,6 +2620,8 @@
 				buffer_offset -= response->ip_data_len;
 				break;
 			}
+			PRIV_EXPDATASN(io) += howmany(response->ip_data_len,
+			    cs->cs_conn->ic_max_send_data_segment_length);
 			if (cb != NULL) {
 				response->ip_prv0 = io->scsiio.kern_data_ref;
 				response->ip_prv1 = io->scsiio.kern_data_arg;
@@ -2654,6 +2657,8 @@
 			}
 		}
 		KASSERT(response->ip_data_len > 0, ("sending empty Data-In"));
+		PRIV_EXPDATASN(io) += howmany(response->ip_data_len,
+		    cs->cs_conn->ic_max_send_data_segment_length);
 		if (cb != NULL) {
 			response->ip_prv0 = io->scsiio.kern_data_ref;
 			response->ip_prv1 = io->scsiio.kern_data_arg;
Index: sys/dev/iscsi/icl.h
===================================================================
--- sys/dev/iscsi/icl.h
+++ sys/dev/iscsi/icl.h
@@ -111,6 +111,7 @@
 	bool			ic_receive_running;
 	uint32_t		ic_max_recv_data_segment_length;
 	uint32_t		ic_max_send_data_segment_length;
+	size_t			ic_hw_isomax;
 	size_t			ic_maxtags;
 	bool			ic_disconnecting;
 	bool			ic_iser;
Index: sys/dev/iscsi/iscsi.c
===================================================================
--- sys/dev/iscsi/iscsi.c
+++ sys/dev/iscsi/iscsi.c
@@ -1154,7 +1154,7 @@
 	struct iscsi_bhs_data_out *bhsdo;
 	struct iscsi_outstanding *io;
 	struct ccb_scsiio *csio;
-	size_t off, len, total_len;
+	size_t off, len, max_send_data_segment_length, total_len;
 	int error;
 	uint32_t datasn = 0;
 
@@ -1203,11 +1203,16 @@
 
 	//ISCSI_SESSION_DEBUG(is, "r2t; off %zd, len %zd", off, total_len);
 
+	if (is->is_conn->ic_hw_isomax != 0)
+		max_send_data_segment_length = is->is_conn->ic_hw_isomax;
+	else
+		max_send_data_segment_length =
+		    is->is_conn->ic_max_send_data_segment_length;
 	for (;;) {
 		len = total_len;
 
-		if (len > is->is_conn->ic_max_send_data_segment_length)
-			len = is->is_conn->ic_max_send_data_segment_length;
+		if (len > max_send_data_segment_length)
+			len = max_send_data_segment_length;
 
 		if (off + len > csio->dxfer_len) {
 			ISCSI_SESSION_WARN(is, "target requested invalid "
@@ -1232,7 +1237,7 @@
 		    bhsr2t->bhsr2t_initiator_task_tag;
 		bhsdo->bhsdo_target_transfer_tag =
 		    bhsr2t->bhsr2t_target_transfer_tag;
-		bhsdo->bhsdo_datasn = htonl(datasn++);
+		bhsdo->bhsdo_datasn = htonl(datasn);
 		bhsdo->bhsdo_buffer_offset = htonl(off);
 		error = icl_pdu_append_data(request, csio->data_ptr + off, len,
 		    M_NOWAIT);
@@ -1245,6 +1250,8 @@
 			return;
 		}
 
+		datasn += howmany(len,
+		    is->is_conn->ic_max_send_data_segment_length);
 		off += len;
 		total_len -= len;