diff --git a/sys/dev/drm/amd/amdgpu/amdgpu_atombios.c b/sys/dev/drm/amd/amdgpu/amdgpu_atombios.c
--- a/sys/dev/drm/amd/amdgpu/amdgpu_atombios.c
+++ b/sys/dev/drm/amd/amdgpu/amdgpu_atombios.c
@@ -137,6 +137,13 @@ static void amdgpu_atombios_i2c_init(struct amdgpu_device *adev)
 		num_indices = (size - sizeof(ATOM_COMMON_TABLE_HEADER)) /
 			sizeof(ATOM_GPIO_I2C_ASSIGMENT);
 
+		/* DF-1407: num_indices is derived from the VBIOS usStructureSize
+		 * with no upper bound. adev->i2c_bus[] is fixed at
+		 * AMDGPU_MAX_I2C_BUS (16); an inflated/crafted size writes
+		 * thousands of pointers past the array into struct amdgpu_device. */
+		if (num_indices > AMDGPU_MAX_I2C_BUS)
+			num_indices = AMDGPU_MAX_I2C_BUS;
+
 		gpio = &i2c_info->asGPIO_Info[0];
 		for (i = 0; i < num_indices; i++) {