diff --git a/sys/dev/drm/radeon/r600_dpm.c b/sys/dev/drm/radeon/r600_dpm.c
--- a/sys/dev/drm/radeon/r600_dpm.c
+++ b/sys/dev/drm/radeon/r600_dpm.c
@@ -1097,6 +1097,18 @@
 				r600_free_extended_power_table(rdev);
 				return -ENOMEM;
 			}
+			/*
+			 * DF-1566: VCE/UVD limit and state loops index
+			 * array->entries[ucVCEClockInfoIndex] and limits->entries[i]
+			 * using firmware-controlled UCHAR indices never validated
+			 * against array->ucNumEntries / limits->numEntries.  Reject
+			 * tables whose declared counts exceed a sane maximum.
+			 */
+			if (array->ucNumEntries == 0 || array->ucNumEntries > 32 ||
+			    limits->numEntries == 0 || limits->numEntries > 32) {
+				r600_free_extended_power_table(rdev);
+				return -EINVAL;
+			}
 			rdev->pm.dpm.dyn_state.vce_clock_voltage_dependency_table.count =
 				limits->numEntries;
 			entry = &limits->entries[0];