diff --git a/sys/dev/drm/amd/amdgpu/amdgpu_bios.c b/sys/dev/drm/amd/amdgpu/amdgpu_bios.c
--- a/sys/dev/drm/amd/amdgpu/amdgpu_bios.c
+++ b/sys/dev/drm/amd/amdgpu/amdgpu_bios.c
@@ -262,6 +262,16 @@
 	}
 
 	obj = (ACPI_OBJECT *)buffer.Pointer;
+	/* The ACPI_OBJECT union reuses offset 8 for Integer.Value and
+	 * Buffer.Pointer/Length; reject non-Buffer returns. */
+	if (obj->Type != ACPI_TYPE_BUFFER) {
+		DRM_ERROR("ATRM returned non-buffer ACPI object (type=%d)\n",
+			  obj->Type);
+		AcpiOsFree(buffer.Pointer);
+		return -ENODEV;
+	}
+	if (offset + obj->Buffer.Length > ATRM_BIOS_PAGE)
+		obj->Buffer.Length = ATRM_BIOS_PAGE - offset;
 	memcpy(bios+offset, obj->Buffer.Pointer, obj->Buffer.Length);
 	len = obj->Buffer.Length;
 	AcpiOsFree(buffer.Pointer);