Secure metadata protection

A data storage device, comprising:

• a memory device;
• a controller coupled to the memory device, wherein the controller comprises:
• a host interface module (HIM);
• and
• a direct memory access (DMA) coupled to the HIM, wherein the DMA is configured to:
• fetch metadata associated with a read command, wherein the read command has a first data identifier, and wherein the fetched metadata has a second data identifier;
• fetch data associated with the read command, wherein the fetched data has a third data identifier;
• determine if the first data identifier, the second data identifier, and the third identifier match;
• and
• provide a requester of the read command either:
• unmodified fetched data when the first data identifier, the second data identifier, and the third identifier match;
• or
• modified fetched data when the first data identifier, the second data identifier, and the third identifier do not match, wherein the DMA comprises a multiplexer (MUX) switch, wherein the first data identifier, the second data identifier, and the third data identifier are provided to the MUX switch, wherein the first data identifier includes an actual cyclic redundancy code (CRC), an actual namespace (NS), and an actual logical block address (LBA), wherein the second data identifier includes an expected CRC, an expected NS, and an expected LBA, and the third data identifier includes a calculated CRC.