diff --git a/sys/dev/drm/amd/powerplay/hwmgr/processpptables.c b/sys/dev/drm/amd/powerplay/hwmgr/processpptables.c
--- a/sys/dev/drm/amd/powerplay/hwmgr/processpptables.c
+++ b/sys/dev/drm/amd/powerplay/hwmgr/processpptables.c
@@ -1096,6 +1096,13 @@ static int get_uvd_clock_voltage_limit_table(struct pp_hwmgr *hwmgr,
 	uvd_table->count = table->numEntries;
 
 	for (i = 0; i < table->numEntries; i++) {
+		/* DF-1468: ucUVDClockInfoIndex is a UCHAR taken directly from the
+		 * VBIOS and used to index array->entries[] (a flex array whose real
+		 * length is array->ucNumEntries) with no bound check. A crafted
+		 * index reads OOB past the VBIOS buffer. */
+		if (table->entries[i].ucUVDClockInfoIndex >= array->ucNumEntries)
+			return -EINVAL;
+
 		const UVDClockInfo *entry =
 			&array->entries[table->entries[i].ucUVDClockInfoIndex];
 		uvd_table->entries[i].v = (unsigned long)le16_to_cpu(table->entries[i].usVoltage);