diff --git a/sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c b/sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c
--- a/sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c
+++ b/sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c
@@ -1031,9 +1031,15 @@
 	if (table == NULL)
 		return -ENOMEM;
 
-	table->count = vddc_lookup_pp_tables->ucNumEntries;
+	/* ucNumEntries comes from VBIOS (UCHAR, 0..255) but the buffer was
+	 * sized for max_levels entries.  Clamp the count and loop bound to
+	 * max_levels to prevent an out-of-bounds write past the slab object. */
+	if (vddc_lookup_pp_tables->ucNumEntries > max_levels)
+		table->count = max_levels;
+	else
+		table->count = vddc_lookup_pp_tables->ucNumEntries;
 
-	for (i = 0; i < vddc_lookup_pp_tables->ucNumEntries; i++)
+	for (i = 0; i < table->count; i++)
 		table->entries[i].us_vdd =
 				le16_to_cpu(vddc_lookup_pp_tables->entries[i].usVdd);