diff --git a/sys/dev/video/fb/bmp/splash_bmp.c b/sys/dev/video/fb/bmp/splash_bmp.c
--- a/sys/dev/video/fb/bmp/splash_bmp.c
+++ b/sys/dev/video/fb/bmp/splash_bmp.c
@@ -82,6 +82,16 @@
 	lwkt_reltoken(&vga_token);
 	return ENODEV;
     }
+    /* Require at least BITMAPFILEHEADER(14)+BITMAPINFOHEADER(40)=54 bytes
+     * and validate bfOffBits (read later in bmp_Init) is in-bounds.  Without
+     * this, a truncated or crafted splash image drives bmp_DecodeRLE8/RLE4
+     * walks past the end of the image into kernel memory. */
+    if (bmp_decoder.data_size < 54) {
+	kprintf("splash_bmp: bitmap too small (%zd bytes)\n",
+	    bmp_decoder.data_size);
+	lwkt_reltoken(&vga_token);
+	return ENODEV;
+    }
     for (i = 0; modes[i] >= 0; ++i) {
 	if (((*vidsw[adp->va_index]->get_info)(adp, modes[i], &info) == 0)
 	    && (bmp_Init((u_char *)bmp_decoder.data,