diff --git a/sys/dev/drm/drm_edid.c b/sys/dev/drm/drm_edid.c
--- a/sys/dev/drm/drm_edid.c
+++ b/sys/dev/drm/drm_edid.c
@@ -5109,6 +5109,18 @@
 	u8 num_v_tile, num_h_tile;
 	struct drm_tile_group *tg;
 
+	/*
+	 * The body of a tiled display block (everything after the 3-byte
+	 * displayid_block header) must be large enough to cover the full
+	 * displayid_tiled_block layout, otherwise field reads below walk
+	 * off the end of the EDID extension into adjacent kernel heap.
+	 * The caller's loop only checks num_bytes against the buffer length,
+	 * not against the struct size.
+	 */
+	if (block->num_bytes < sizeof(struct displayid_tiled_block) -
+	    sizeof(struct displayid_block))
+		return -EINVAL;
+
 	w = tile->tile_size[0] | tile->tile_size[1] << 8;
 	h = tile->tile_size[2] | tile->tile_size[3] << 8;