Index: sys/dev/mps/mps.c
===================================================================
--- sys/dev/mps/mps.c
+++ sys/dev/mps/mps.c
@@ -1382,6 +1382,9 @@
 		return;
 
 	for (i = 0, o = 0, s = 0; s < nsegs; s++) {
+		KASSERT(segs[s].ds_addr + segs[s].ds_len - 1 <= BUS_SPACE_MAXADDR_32BIT,
+		    ("mps: Bad segment address %#jx len %#jx\n", (uintmax_t)segs[s].ds_addr,
+			(uintmax_t)segs[s].ds_len));
 		for (bo = 0; bo + sc->reqframesz <= segs[s].ds_len;
 		    bo += sc->reqframesz) {
 			chain = &sc->chains[i++];
@@ -2696,7 +2699,7 @@
 static int
 mps_add_chain(struct mps_command *cm)
 {
-	MPI2_SGE_CHAIN32 *sgc;
+	MPI2_SGE_CHAIN64 *sgc;
 	struct mps_chain *chain;
 	u_int space;
 
@@ -2715,17 +2718,18 @@
 	 */
 	TAILQ_INSERT_TAIL(&cm->cm_chain_list, chain, chain_link);
 
-	sgc = (MPI2_SGE_CHAIN32 *)&cm->cm_sge->MpiChain;
+	sgc = (MPI2_SGE_CHAIN64 *)&cm->cm_sge->MpiChain;
 	sgc->Length = htole16(space);
 	sgc->NextChainOffset = 0;
 	/* TODO Looks like bug in Setting sgc->Flags. 
 	 *	sgc->Flags = ( MPI2_SGE_FLAGS_CHAIN_ELEMENT | MPI2_SGE_FLAGS_64_BIT_ADDRESSING |
 	 *	            MPI2_SGE_FLAGS_SYSTEM_ADDRESS) << MPI2_SGE_FLAGS_SHIFT
 	 *	This is fine.. because we are not using simple element. In case of 
-	 *	MPI2_SGE_CHAIN32, we have separate Length and Flags feild.
+	 *	MPI2_SGE_CHAIN64, we have separate Length and Flags feild.
  	 */
-	sgc->Flags = MPI2_SGE_FLAGS_CHAIN_ELEMENT;
-	sgc->Address = htole32(chain->chain_busaddr);
+	sgc->Flags = MPI2_SGE_FLAGS_CHAIN_ELEMENT | MPI2_SGE_FLAGS_64_BIT_ADDRESSING;
+	sgc->Address.High = htole32(chain->chain_busaddr >> 32);
+	sgc->Address.Low = htole32(chain->chain_busaddr);
 
 	cm->cm_sge = (MPI2_SGE_IO_UNION *)&chain->chain->MpiSimple;
 	cm->cm_sglsize = space;
@@ -2757,7 +2761,7 @@
 		}
 		break;
 	case MPI2_SGE_FLAGS_CHAIN_ELEMENT:
-		/* Driver only uses 32-bit chain elements */
+		/* Driver only uses 64-bit chain elements */
 		if (len != MPS_SGC_SIZE)
 			panic("CHAIN %p length %u or %zu?", sgep,
 			    MPS_SGC_SIZE, len);
Index: sys/dev/mps/mps_user.c
===================================================================
--- sys/dev/mps/mps_user.c
+++ sys/dev/mps/mps_user.c
@@ -468,12 +468,6 @@
 	MPI2_FW_DOWNLOAD_TCSGE tc;
 	int error;
 
-	/*
-	 * This code assumes there is room in the request's SGL for
-	 * the TransactionContext plus at least a SGL chain element.
-	 */
-	CTASSERT(sizeof req->SGL >= sizeof tc + MPS_SGC_SIZE);
-
 	if (cmd->req_len != sizeof *req)
 		return (EINVAL);
 	if (cmd->rpl_len != sizeof *rpl)
@@ -521,12 +515,6 @@
 	MPI2_FW_UPLOAD_REPLY *rpl;
 	MPI2_FW_UPLOAD_TCSGE tc;
 
-	/*
-	 * This code assumes there is room in the request's SGL for
-	 * the TransactionContext plus at least a SGL chain element.
-	 */
-	CTASSERT(sizeof req->SGL >= sizeof tc + MPS_SGC_SIZE);
-
 	if (cmd->req_len != sizeof *req)
 		return (EINVAL);
 	if (cmd->rpl_len != sizeof *rpl)
Index: sys/dev/mps/mpsvar.h
===================================================================
--- sys/dev/mps/mpsvar.h
+++ sys/dev/mps/mpsvar.h
@@ -53,7 +53,7 @@
 #define MPS_MSIX_MAX		16
 #define MPS_SGE64_SIZE		12
 #define MPS_SGE32_SIZE		8
-#define MPS_SGC_SIZE		8
+#define MPS_SGC_SIZE		12
 
 #define	 CAN_SLEEP			1
 #define  NO_SLEEP			0
@@ -199,7 +199,7 @@
 struct mps_chain {
 	TAILQ_ENTRY(mps_chain)		chain_link;
 	MPI2_SGE_IO_UNION		*chain;
-	uint32_t			chain_busaddr;
+	uint64_t			chain_busaddr;
 };
 
 /*