diff --git a/sys/dev/drm/amd/powerplay/hwmgr/processpptables.c b/sys/dev/drm/amd/powerplay/hwmgr/processpptables.c
--- a/sys/dev/drm/amd/powerplay/hwmgr/processpptables.c
+++ b/sys/dev/drm/amd/powerplay/hwmgr/processpptables.c
@@ -377,9 +377,21 @@
 		const ATOM_PPLIB_Clock_Voltage_Dependency_Table *table)
 {
 
-	unsigned long table_size, i;
+	unsigned long table_size, i, num_entries;
 	struct phm_clock_voltage_dependency_table *dep_table;
 
+	/* DF-1469: ucNumEntries is a UCHAR taken directly from the VBIOS and used
+	 * to size both the destination kmalloc and the source loop. It is never
+	 * validated against the actual firmware image size (soft_pp_table_size
+	 * is tracked but not plumbed in here), so an inflated count reads OOB
+	 * past the VBIOS buffer. Cap it at a sane hardware maximum; no AMD ASIC
+	 * has more than a handful of clock/voltage dependency entries. The same
+	 * defensive bound must be applied at every sibling parser in this file
+	 * (uvd, vce, samu, acp, cac_leakage, phase_shed). */
+	num_entries = table->ucNumEntries;
+	if (num_entries > 128)
+		return -EINVAL;
+
 	table_size = sizeof(unsigned long) +
 		sizeof(struct phm_clock_voltage_dependency_table)
 		* table->ucNumEntries;