diff --git a/sys/dev/drm/i915/intel_bios.c b/sys/dev/drm/i915/intel_bios.c
--- a/sys/dev/drm/i915/intel_bios.c
+++ b/sys/dev/drm/i915/intel_bios.c
@@ -93,7 +93,10 @@
 		current_size = _get_blocksize(base + index);
 		index += 3;
 
-		if (index + current_size > total)
+		/* current_size is u32 (MIPI v3 _get_blocksize returns u32) and
+		 * can wrap (u32)index + (u32)current_size, accepting a block
+		 * that extends past BDB. Rewrite overflow-safe. */
+		if (current_size > total - index)
 			return NULL;
 
 		if (current_id == section_id)