diff --git a/sys/dev/drm/amd/display/dc/core/dc_resource.c b/sys/dev/drm/amd/display/dc/core/dc_resource.c
--- a/sys/dev/drm/amd/display/dc/core/dc_resource.c
+++ b/sys/dev/drm/amd/display/dc/core/dc_resource.c
@@ -1564,6 +1564,13 @@
 	struct dc_validation_set set;
 	int i;
 
+	/* DF-1300: plane_states[] in dc_validation_set is fixed at MAX_SURFACES.
+	 * Clamp plane_count before writing, otherwise a caller passing
+	 * plane_count > MAX_SURFACES overwrites the stack frame past the array
+	 * (plane_count field, padding, saved registers). */
+	if (plane_count > MAX_SURFACES)
+		plane_count = MAX_SURFACES;
+
 	set.stream = stream;
 	set.plane_count = plane_count;