diff --git a/sys/dev/drm/drm_dp_mst_topology.c b/sys/dev/drm/drm_dp_mst_topology.c
--- a/sys/dev/drm/drm_dp_mst_topology.c
+++ b/sys/dev/drm/drm_dp_mst_topology.c
@@ -443,6 +443,9 @@
 	if (idx > raw->curlen)
 		goto fail_len;
 
+	if (repmsg->u.remote_dpcd_read_ack.num_bytes >
+	    (int)sizeof(repmsg->u.remote_dpcd_read_ack.bytes))
+		goto fail_len;
 	memcpy(repmsg->u.remote_dpcd_read_ack.bytes, &raw->msg[idx], repmsg->u.remote_dpcd_read_ack.num_bytes);
 	return true;
 fail_len: