diff --git a/sys/dev/drm/i915/intel_bios.c b/sys/dev/drm/i915/intel_bios.c
--- a/sys/dev/drm/i915/intel_bios.c
+++ b/sys/dev/drm/i915/intel_bios.c
@@ -836,6 +836,14 @@
 	 * get hold of the correct configuration block and pps data as per
 	 * the panel_type as index
 	 */
+	/* panel_type is validated 0..15 (4 bits) upstream, but the config[]
+	 * and pps[] arrays are only [MAX_MIPI_CONFIGURATIONS=6]. Reject
+	 * panel_type >= 6 to avoid ~125-1250 byte OOB read. */
+	if (panel_type < 0 || panel_type >= MAX_MIPI_CONFIGURATIONS) {
+		DRM_DEBUG_KMS("MIPI panel_type %d out of range [0,%d)\n",
+			      panel_type, MAX_MIPI_CONFIGURATIONS);
+		return;
+	}
 	config = &start->config[panel_type];
 	pps = &start->pps[panel_type];