diff --git a/sys/dev/drm/amd/amdgpu/amdgpu_vcn.c b/sys/dev/drm/amd/amdgpu/amdgpu_vcn.c
--- a/sys/dev/drm/amd/amdgpu/amdgpu_vcn.c
+++ b/sys/dev/drm/amd/amdgpu/amdgpu_vcn.c
@@ -121,9 +121,15 @@
 			version_major, version_minor, family_id);
 	}
 
-	bo_size = AMDGPU_VCN_STACK_SIZE + AMDGPU_VCN_CONTEXT_SIZE;
-	if (adev->firmware.load_type != AMDGPU_FW_LOAD_PSP)
-		bo_size += AMDGPU_GPU_PAGE_ALIGN(le32_to_cpu(hdr->ucode_size_bytes) + 8);
+	bo_size = AMDGPU_VCN_STACK_SIZE + AMDGPU_VCN_CONTEXT_SIZE;
+	if (adev->firmware.load_type != AMDGPU_FW_LOAD_PSP) {
+		uint32_t ucode_size = le32_to_cpu(hdr->ucode_size_bytes);
+		if (ucode_size == 0 || ucode_size > adev->vcn.fw->datasize) {
+			dev_err(adev->dev, "invalid VCN firmware ucode_size_bytes\n");
+			return -EINVAL;
+		}
+		bo_size += AMDGPU_GPU_PAGE_ALIGN(ucode_size + 8);
+	}
 	r = amdgpu_bo_create_kernel(adev, bo_size, PAGE_SIZE,
 				    AMDGPU_GEM_DOMAIN_VRAM, &adev->vcn.vcpu_bo,
 				    (u64 *)&adev->vcn.gpu_addr, &adev->vcn.cpu_addr);