diff --git a/sys/dev/drm/radeon/r300.c b/sys/dev/drm/radeon/r300.c
--- a/sys/dev/drm/radeon/r300.c
+++ b/sys/dev/drm/radeon/r300.c
@@ -1175,6 +1175,10 @@
 	ib = p->ib.ptr;
 	idx = pkt->idx + 1;
 	track = (struct r100_cs_track *)p->track;
+	/* opcodes below reference ib[idx] (and ib[idx+1] for some);
+	 * require at least one parameter dword past the header */
+	if (pkt->count < 1)
+		return -EINVAL;
 	switch(pkt->opcode) {
 	case PACKET3_3D_LOAD_VBPNTR:
 		r = r100_packet3_load_vbpntr(p, pkt, idx);