diff --git a/sys/dev/drm/radeon/radeon_vce.c b/sys/dev/drm/radeon/radeon_vce.c
--- a/sys/dev/drm/radeon/radeon_vce.c
+++ b/sys/dev/drm/radeon/radeon_vce.c
@@ -564,7 +564,18 @@
 
 	while (p->idx < p->chunk_ib->length_dw) {
 		uint32_t len = radeon_get_ib_value(p, p->idx);
-		uint32_t cmd = radeon_get_ib_value(p, p->idx + 1);
+		uint32_t cmd;
+
+		/* DF-1753: every command reads at least p->idx+1, and the
+		 * encode/context cases read up to p->idx+12.  Make sure the
+		 * whole command fits in the IB before touching any field. */
+		if (p->idx + len > p->chunk_ib->length_dw) {
+			DRM_ERROR("VCE command at %d len %d overflows IB (%d)!\n",
+				  p->idx, len, p->chunk_ib->length_dw);
+			r = -EINVAL;
+			goto out;
+		}
+		cmd = radeon_get_ib_value(p, p->idx + 1);
 
 		if ((len < 8) || (len & 3)) {
 			DRM_ERROR("invalid VCE command length (%d)!\n", len);