diff --git a/sys/dev/drm/i915/i915_cmd_parser.c b/sys/dev/drm/i915/i915_cmd_parser.c
--- a/sys/dev/drm/i915/i915_cmd_parser.c
+++ b/sys/dev/drm/i915/i915_cmd_parser.c
@@ -1099,6 +1099,16 @@
 			batch_len = roundup(batch_len,
 					    boot_cpu_data.x86_clflush_size);
 
+		/*
+		 * DF-1559: batch_len is u32 from the EXECBUFFER2 user args;
+		 * the min_t(int, ...) below casts it to int, and any batch_len
+		 * >= 0x80000000 becomes INT_MIN -- min returns INT_MIN, the
+		 * subsequent memcpy promotes the negative to a giant size_t and
+		 * clobbers kernel memory.  Reject such pathological lengths.
+		 */
+		if (batch_len > INT_MAX)
+			return -EINVAL;
+
 		ptr = dst;
 		for (n = batch_start_offset >> PAGE_SHIFT; batch_len; n++) {
 			int len = min_t(int, batch_len, PAGE_SIZE - offset);