diff --git a/sys/dev/drm/amd/amdgpu/amdgpu_cs.c b/sys/dev/drm/amd/amdgpu/amdgpu_cs.c
--- a/sys/dev/drm/amd/amdgpu/amdgpu_cs.c
+++ b/sys/dev/drm/amd/amdgpu/amdgpu_cs.c
@@ -56,7 +56,11 @@ static int amdgpu_cs_user_fence_chunk(struct amdgpu_cs_parser *p,
 	drm_gem_object_put_unlocked(gobj);
 
 	size = amdgpu_bo_size(bo);
-	if (size != PAGE_SIZE || (data->offset + 8) > size) {
+	/* DF-1483: (data->offset + 8) was computed in 32-bit arithmetic; with
+	 * data->offset = 0xFFFFFFF8 the add wraps to 0 and bypasses the check,
+	 * so the GPU later writes 8 bytes ~4GB past the PAGE_SIZE fence BO.
+	 * Use 64-bit math (matches upstream Linux). */
+	if (size != PAGE_SIZE || ((uint64_t)data->offset + 8) > size) {
 		r = -EINVAL;
 		goto error_unref;
 	}