diff --git a/sys/dev/drm/amd/amdgpu/amdgpu_psp.c b/sys/dev/drm/amd/amdgpu/amdgpu_psp.c
--- a/sys/dev/drm/amd/amdgpu/amdgpu_psp.c
+++ b/sys/dev/drm/amd/amdgpu/amdgpu_psp.c
@@ -251,6 +251,12 @@
 	if (!cmd)
 		return -ENOMEM;
 
+	/* asd_ucode_size is read verbatim from the on-disk firmware header
+	 * (ucode_size_bytes); cap it to fw_pri_buf (PSP_1_MEG) to prevent
+	 * a heap overflow on the memcpy below. */
+	if (psp->asd_ucode_size > PSP_1_MEG)
+		return -EINVAL;
+
 	memset(psp->fw_pri_buf, 0, PSP_1_MEG);
 	memcpy(psp->fw_pri_buf, psp->asd_start_addr, psp->asd_ucode_size);