diff --git a/sys/dev/drm/amd/amdgpu/amdgpu_vce.c b/sys/dev/drm/amd/amdgpu/amdgpu_vce.c
--- a/sys/dev/drm/amd/amdgpu/amdgpu_vce.c
+++ b/sys/dev/drm/amd/amdgpu/amdgpu_vce.c
@@ -731,6 +731,13 @@
 			goto out;
 		}
 
+		/* Ensure the whole command (including later idx+N reads) is in bounds. */
+		if (idx + len > ib->length_dw) {
+			DRM_ERROR("VCE command exceeds IB length!\n");
+			r = -EINVAL;
+			goto out;
+		}
+
 		switch (cmd) {
 		case 0x00000002: /* task info */
 			fb_idx = amdgpu_get_ib_value(p, ib_idx, idx + 6);