diff --git a/sys/dev/drm/amd/display/dc/bios/bios_parser.c b/sys/dev/drm/amd/display/dc/bios/bios_parser.c
--- a/sys/dev/drm/amd/display/dc/bios/bios_parser.c
+++ b/sys/dev/drm/amd/display/dc/bios/bios_parser.c
@@ -2652,6 +2652,10 @@
 
 	/* get info for each connector in the slot */
 	slot_layout_info->num_of_connectors = record->ucConnNum;
+	/* ucConnNum is an attacker-influenced VBIOS byte; clamp to the
+	 * fixed connectors[] array or this loop overflows slot_layout_info. */
+	if (slot_layout_info->num_of_connectors > MAX_CONNECTOR_NUMBER_PER_SLOT)
+		slot_layout_info->num_of_connectors = MAX_CONNECTOR_NUMBER_PER_SLOT;
 	for (j = 0; j < slot_layout_info->num_of_connectors; ++j) {
 		slot_layout_info->connectors[j].connector_type =
 			(enum connector_layout_type)