diff --git a/sys/dev/drm/amd/display/dc/core/dc_link_dp.c b/sys/dev/drm/amd/display/dc/core/dc_link_dp.c
--- a/sys/dev/drm/amd/display/dc/core/dc_link_dp.c
+++ b/sys/dev/drm/amd/display/dc/core/dc_link_dp.c
@@ -1780,6 +1780,24 @@
 			(unsigned char *)(&link_settings.link_rate),
 			1);
 
+	/*
+	 * DF-1319: DP_TEST_LANE_COUNT is an attacker-controlled byte read
+	 * straight from the sink (DPCD 0x220, 5-bit field 0..31).  It must be
+	 * one of the valid DP lane counts; otherwise the value is propagated
+	 * into the link-training helpers and overflows the fixed-size stack
+	 * arrays dpcd_lane[LANE_COUNT_DP_MAX=4] / dpcd_lt_buffer[5] /
+	 * dpcd_lane_adjust[4].  Reject anything that is not {1, 2, 4} by
+	 * falling back to the verified link capability.
+	 */
+	if (link_settings.lane_count != LANE_COUNT_ONE &&
+	    link_settings.lane_count != LANE_COUNT_TWO &&
+	    link_settings.lane_count != LANE_COUNT_FOUR) {
+		DC_LOG_WARNING("%s: invalid TEST_LANE_COUNT %d from sink; "
+				"ignoring automated link-training request\n",
+				__func__, link_settings.lane_count);
+		return;
+	}
+
 	/* Set preferred link settings */
 	link->verified_link_cap.lane_count = link_settings.lane_count;
 	link->verified_link_cap.link_rate = link_settings.link_rate;