diff --git a/sys/dev/drm/amd/display/dc/bios/bios_parser2.c b/sys/dev/drm/amd/display/dc/bios/bios_parser2.c
--- a/sys/dev/drm/amd/display/dc/bios/bios_parser2.c
+++ b/sys/dev/drm/amd/display/dc/bios/bios_parser2.c
@@ -1730,6 +1730,14 @@
 
 	/* get info for each connector in the slot */
 	slot_layout_info->num_of_connectors = record->conn_num;
+
+	/* DF-1413: conn_num is a u8 taken directly from the VBIOS record with no
+	 * bound check. connectors[] is fixed at MAX_CONNECTOR_NUMBER_PER_SLOT
+	 * (16); a crafted conn_num > 16 overflows into board_layout_info /
+	 * adjacent heap. */
+	if (slot_layout_info->num_of_connectors > MAX_CONNECTOR_NUMBER_PER_SLOT)
+		slot_layout_info->num_of_connectors = MAX_CONNECTOR_NUMBER_PER_SLOT;
+
 	for (j = 0; j < slot_layout_info->num_of_connectors; ++j) {
 		slot_layout_info->connectors[j].connector_type =
 			(enum connector_layout_type)