diff --git a/sys/dev/drm/amd/amdgpu/sdma_v4_0.c b/sys/dev/drm/amd/amdgpu/sdma_v4_0.c
--- a/sys/dev/drm/amd/amdgpu/sdma_v4_0.c
+++ b/sys/dev/drm/amd/amdgpu/sdma_v4_0.c
@@ -305,6 +305,8 @@
 		err = amdgpu_ucode_validate(adev->sdma.instance[i].fw);
 		if (err)
 			goto out;
+		if (adev->sdma.instance[i].fw->datasize < sizeof(*hdr))
+			return -EINVAL;
 		hdr = (const struct sdma_firmware_header_v1_0 *)adev->sdma.instance[i].fw->data;
 		adev->sdma.instance[i].fw_version = le32_to_cpu(hdr->header.ucode_version);
 		adev->sdma.instance[i].feature_version = le32_to_cpu(hdr->ucode_feature_version);