diff --git a/sys/dev/drm/amd/amdgpu/psp_v3_1.c b/sys/dev/drm/amd/amdgpu/psp_v3_1.c
--- a/sys/dev/drm/amd/amdgpu/psp_v3_1.c
+++ b/sys/dev/drm/amd/amdgpu/psp_v3_1.c
@@ -138,6 +138,13 @@
 	adev->psp.sos_start_addr = (uint8_t *)adev->psp.sys_start_addr +
 				le32_to_cpu(hdr->sos_offset_bytes);
 
+	if (adev->psp.sos_fw->datasize < le32_to_cpu(hdr->header.ucode_size_bytes) ||
+	    le32_to_cpu(hdr->header.ucode_size_bytes) < le32_to_cpu(hdr->sos_size_bytes)) {
+		dev_err(adev->dev, "invalid PSP firmware header\n");
+		err = -EINVAL;
+		goto out;
+	}
+
 	snprintf(fw_name, sizeof(fw_name), "amdgpufw_%s_asd", chip_name);
 	err = request_firmware(&adev->psp.asd_fw, fw_name, adev->dev);
 	if (err)