diff --git a/sys/dev/drm/radeon/radeon.h b/sys/dev/drm/radeon/radeon.h
--- a/sys/dev/drm/radeon/radeon.h
+++ b/sys/dev/drm/radeon/radeon.h
@@ -2331,6 +2331,7 @@
 	int				disp_priority;
 	/* BIOS */
 	uint8_t				*bios;
+	size_t				bios_size;
 	bool				is_atom_bios;
 	uint16_t			bios_header_start;
 	struct radeon_bo		*stolen_vga_memory;
diff --git a/sys/dev/drm/radeon/radeon_bios.c b/sys/dev/drm/radeon/radeon_bios.c
--- a/sys/dev/drm/radeon/radeon_bios.c
+++ b/sys/dev/drm/radeon/radeon_bios.c
@@ -747,14 +747,21 @@
 	if (r == false || rdev->bios == NULL) {
 		DRM_ERROR("Unable to locate a BIOS ROM\n");
 		rdev->bios = NULL;
+		rdev->bios_size = 0;
 		return false;
 	}
+	/* Bound checked reads to the maximum BIOS alloc size (256 KiB). */
+	rdev->bios_size = 256 * 1024;
 	if (rdev->bios[0] != 0x55 || rdev->bios[1] != 0xaa) {
 		printk("BIOS signature incorrect %x %x\n", rdev->bios[0], rdev->bios[1]);
 		goto free_bios;
 	}
 
 	tmp = RBIOS16(0x18);
+	if (tmp + 0x15 > rdev->bios_size) {
+		DRM_INFO("BIOS tmp pointer out of bounds\n");
+		goto free_bios;
+	}
 	if (RBIOS8(tmp + 0x14) != 0x0) {
 		DRM_INFO("Not an x86 BIOS ROM, not using.\n");
 		goto free_bios;