diff --git a/sys/dev/drm/radeon/radeon_atombios.c b/sys/dev/drm/radeon/radeon_atombios.c
--- a/sys/dev/drm/radeon/radeon_atombios.c
+++ b/sys/dev/drm/radeon/radeon_atombios.c
@@ -1531,6 +1531,13 @@
 		ss_info =
 			(union asic_ss_info *)(mode_info->atom_context->bios + data_offset);
 
+		/* DF-1199: size is a u16 supplied by the BIOS table header. Without
+		 * this guard, (size - sizeof(HEADER)) is computed in size_t and
+		 * underflows to ~0 for size < 4, yielding num_indices = 1431655765
+		 * and a ~12 GB out-of-bounds read loop. */
+		if (size < sizeof(ATOM_COMMON_TABLE_HEADER))
+			return false;
+
 		switch (frev) {
 		case 1:
 			num_indices = (size - sizeof(ATOM_COMMON_TABLE_HEADER)) /