I seem CAM_DIR_OUT is correct in this line. https://svnweb.freebsd.org/base/head/share/examples/scsi_target/scsi_cmds.c?view=markup#l334 CAM_DIR_IN is not data copyin at cam_periph_mapmem() by XPT_CONT_TARGET_IO.