diff --git a/sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c b/sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c
--- a/sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c
+++ b/sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c
@@ -1342,6 +1342,13 @@ static int smu8_dpm_get_pp_table_entry_callback(struct pp_hwmgr *hwmgr,
 							const void *clock_info)
 {
 	struct smu8_power_state *smu8_ps = cast_smu8_power_state(hw_ps);
+
+	/* DF-1416: index comes from the VBIOS-supplied ucNumDPMLevels via the
+	 * caller loop in processpptables.c:928, with no bound check against
+	 * SMU8_MAX_HARDWARE_POWERLEVELS (8). levels[] is fixed at [8]; reject
+	 * out-of-range indices instead of overflowing into list pointers. */
+	if (index >= SMU8_MAX_HARDWARE_POWERLEVELS)
+		return -EINVAL;
 
 	const ATOM_PPLIB_CZ_CLOCK_INFO *smu8_clock_info = clock_info;