diff -ur linux-2.6.16.20.orig/fs/smbfs/sock.c wip/fs/smbfs/sock.c
--- linux-2.6.16.20.orig/fs/smbfs/sock.c	2006-05-10 21:56:24.000000000 -0400
+++ linux-2.6.16.20/fs/smbfs/sock.c	2006-06-07 10:55:07.000000000 -0400
@@ -331,8 +331,13 @@
 
 	/* Dont repeat bytes and count available bufferspace */
 	rlen = smb_move_iov(&p, &num, iov, req->rq_bytes_recvd);
-	if (req->rq_rlen < rlen)
-		rlen = req->rq_rlen;
+
+	/*
+	 * Don't request more bytes than we have space for, or more than
+	 * we want for this request.
+	 */
+	if (req->rq_rlen - req->rq_bytes_recvd < rlen)
+		rlen = req->rq_rlen - req->rq_bytes_recvd;
 
 	result = kernel_recvmsg(sock, &msg, p, num, rlen, flags);