diff --git a/sys/dev/drm/amd/amdgpu/amdgpu_gem.c b/sys/dev/drm/amd/amdgpu/amdgpu_gem.c
--- a/sys/dev/drm/amd/amdgpu/amdgpu_gem.c
+++ b/sys/dev/drm/amd/amdgpu/amdgpu_gem.c
@@ -599,6 +599,16 @@
 		return -EINVAL;
 	}
 
+	/* Reject (offset,size) pairs that wrap or exceed the BO.
+	 * The sink in amdgpu_vm_bo_map() (amdgpu_vm.c:2510-2511) only checks
+	 * `offset + size > amdgpu_bo_size(bo)`, which is bypassable when
+	 * offset+size wraps a 64-bit unsigned (DF-1719).  Mirror the
+	 * upstream Linux fix. */
+	if ((args->operation == AMDGPU_VA_OP_MAP ||
+	     args->operation == AMDGPU_VA_OP_REPLACE) &&
+	    args->offset_in_bo >= args->offset_in_bo + args->map_size)
+		return -EINVAL;
+
 	INIT_LIST_HEAD(&list);
 	INIT_LIST_HEAD(&duplicates);
 	if ((args->operation != AMDGPU_VA_OP_CLEAR) &&