Dave,
commit b60710ec7d7ab ("aacraid: enable sending of TMFs from aac_hba_send()")
allows aac_hba_send() to send scsi commands, and TMF requests, but the existing code only updates the iu_type for scsi commands. For TMF requests we are sending an unknown iu_type to firmware, which causes a fault.
Include iu_type prior to determining the validity of the command
Applied to 4.17/scsi-fixes. Thank you!