diff --git a/sys/dev/drm/amd/display/dc/core/dc_link.c b/sys/dev/drm/amd/display/dc/core/dc_link.c
--- a/sys/dev/drm/amd/display/dc/core/dc_link.c
+++ b/sys/dev/drm/amd/display/dc/core/dc_link.c
@@ -2335,6 +2335,19 @@
 	ASSERT(proposed_table->stream_count -
 			link->mst_stream_alloc_table.stream_count < 2);
 
+	/*
+	 * DF-1320: proposed_table->stream_count comes from a (potentially
+	 * malicious) MST branch device via get_payload_table(), which can
+	 * iterate up to max_payloads (63).  work_table[] below is fixed at
+	 * MAX_CONTROLLER_NUM (6); an unchecked stream_count overflows it on
+	 * the stack.  Clamp the iteration to the array size and reject any
+	 * surplus payloads the hub claims.
+	 */
+	if (proposed_table->stream_count > MAX_CONTROLLER_NUM) {
+		BREAK_TO_DEBUGGER();
+		proposed_table->stream_count = MAX_CONTROLLER_NUM;
+	}
+
 	/* copy proposed_table to link, add stream encoder */
 	for (i = 0; i < proposed_table->stream_count; i++) {