if (tcp_conn->in.datalen == 0)
                return 0;
 
-       if (ctask->datasn != datasn)
+       if (tcp_ctask->exp_datasn != datasn) {
+               debug_tcp("%s: ctask->exp_datasn(%d) != rhdr->datasn(%d)\n",
+                         __FUNCTION__, tcp_ctask->exp_datasn, datasn);
                return ISCSI_ERR_DATASN;
+       }
 
-       ctask->datasn++;
+       tcp_ctask->exp_datasn++;
 
        tcp_ctask->data_offset = be32_to_cpu(rhdr->offset);
        if (tcp_ctask->data_offset + tcp_conn->in.datalen > ctask->total_length)
                return ISCSI_ERR_DATALEN;
        }
 
-       if (tcp_ctask->exp_r2tsn && tcp_ctask->exp_r2tsn != r2tsn)
+       if (tcp_ctask->exp_datasn != r2tsn){
+               debug_tcp("%s: ctask->exp_datasn(%d) != rhdr->r2tsn(%d)\n",
+                         __FUNCTION__, tcp_ctask->exp_datasn, r2tsn);
                return ISCSI_ERR_R2TSN;
+       }
 
        rc = iscsi_check_assign_cmdsn(session, (struct iscsi_nopin*)rhdr);
        if (rc)
                return rc;
 
-       /* FIXME: use R2TSN to detect missing R2T */
-
        /* fill-in new R2T associated with the task */
        spin_lock(&session->lock);
        if (!ctask->sc || ctask->mtask ||
 
        iscsi_solicit_data_init(conn, ctask, r2t);
 
-       tcp_ctask->exp_r2tsn = r2tsn + 1;
+       tcp_ctask->exp_datasn = r2tsn + 1;
        __kfifo_put(tcp_ctask->r2tqueue, (void*)&r2t, sizeof(void*));
        tcp_ctask->xmstate |= XMSTATE_SOL_HDR;
        list_move_tail(&ctask->running, &conn->xmitqueue);
 
        tcp_ctask->sent = 0;
        tcp_ctask->sg_count = 0;
+       tcp_ctask->exp_datasn = 0;
 
        if (sc->sc_data_direction == DMA_TO_DEVICE) {
                tcp_ctask->xmstate = XMSTATE_W_HDR;
-               tcp_ctask->exp_r2tsn = 0;
                BUG_ON(ctask->total_length == 0);
 
                if (sc->use_sg) {
 
        struct scatterlist      *sg;                    /* per-cmd SG list  */
        struct scatterlist      *bad_sg;                /* assert statement */
        int                     sg_count;               /* SG's to process  */
-       uint32_t                exp_r2tsn;
+       uint32_t                exp_datasn;             /* expected target's R2TSN/DataSN */
        int                     data_offset;
        struct iscsi_r2t_info   *r2t;                   /* in progress R2T    */
        struct iscsi_queue      r2tpool;
 
         session->cmdsn++;
         hdr->exp_statsn = cpu_to_be32(conn->exp_statsn);
         memcpy(hdr->cdb, sc->cmnd, sc->cmd_len);
-        memset(&hdr->cdb[sc->cmd_len], 0, MAX_COMMAND_SIZE - sc->cmd_len);
+       if (sc->cmd_len < MAX_COMMAND_SIZE)
+               memset(&hdr->cdb[sc->cmd_len], 0,
+                       MAX_COMMAND_SIZE - sc->cmd_len);
 
        ctask->data_count = 0;
        if (sc->sc_data_direction == DMA_TO_DEVICE) {
                        /* No unsolicit Data-Out's */
                        ctask->hdr->flags |= ISCSI_FLAG_CMD_FINAL;
        } else {
-               ctask->datasn = 0;
                hdr->flags |= ISCSI_FLAG_CMD_FINAL;
                zero_data(hdr->dlength);