diff --git a/sys/dev/drm/drm_dp_mst_topology.c b/sys/dev/drm/drm_dp_mst_topology.c
--- a/sys/dev/drm/drm_dp_mst_topology.c
+++ b/sys/dev/drm/drm_dp_mst_topology.c
@@ -349,6 +349,12 @@
 		msg->curchunk_len = recv_hdr.msg_len;
 		msg->curchunk_hdrlen = hdrlen;
 
+		if (msg->curchunk_len > sizeof(msg->chunk)) {
+			DRM_DEBUG_KMS("DP MST sideband msg chunk len %u > %zu\n",
+				msg->curchunk_len, sizeof(msg->chunk));
+			return false;
+		}
+
 		/* we have already gotten an somt - don't bother parsing */
 		if (recv_hdr.somt && msg->have_somt)
 			return false;
@@ -364,6 +370,8 @@
 		msg->curchunk_idx = min(msg->curchunk_len, (u8)(replybuflen - hdrlen));
 		memcpy(&msg->chunk[0], replybuf + hdrlen, msg->curchunk_idx);
 	} else {
+		if (msg->curchunk_idx + replybuflen > msg->curchunk_len)
+			return false;
 		memcpy(&msg->chunk[msg->curchunk_idx], replybuf, replybuflen);
 		msg->curchunk_idx += replybuflen;
 	}