diff --git a/sys/dev/drm/amd/powerplay/amd_powerplay.c b/sys/dev/drm/amd/powerplay/amd_powerplay.c
--- a/sys/dev/drm/amd/powerplay/amd_powerplay.c
+++ b/sys/dev/drm/amd/powerplay/amd_powerplay.c
@@ -613,6 +613,18 @@
 
 	if (!hwmgr || !hwmgr->pm_en ||!hwmgr->ps)
 		return -EINVAL;
+
+	/*
+	 * DF-1561: hwmgr->num_ps comes from a VBIOS u8 ucNumEntries
+	 * (max 255) but data->states[] is fixed at [16] (struct
+	 * pp_states_info).  Without a clamp, num_ps > 16 walks off the
+	 * caller's stack.  Cap at the array size.
+	 */
+	if (hwmgr->num_ps > 16) {
+		pr_err("amdgpu: VBIOS reports %d power states; clamping to 16\n",
+		       hwmgr->num_ps);
+		hwmgr->num_ps = 16;
+	}
 
 	mutex_lock(&hwmgr->smu_lock);