diff --git a/sys/dev/drm/amd/amdgpu/psp_v10_0.c b/sys/dev/drm/amd/amdgpu/psp_v10_0.c
--- a/sys/dev/drm/amd/amdgpu/psp_v10_0.c
+++ b/sys/dev/drm/amd/amdgpu/psp_v10_0.c
@@ -143,6 +143,14 @@
 	adev->psp.asd_start_addr = (uint8_t *)hdr +
 				le32_to_cpu(hdr->header.ucode_array_offset_bytes);
 
+				/* Reject firmware whose header offsets/sizes would index past
+				 * the end of the loaded blob.  amdgpu_ucode_validate only checks total size. */
+				if (le32_to_cpu(hdr->header.ucode_array_offset_bytes) +
+				    adev->psp.asd_ucode_size > adev->psp.asd_fw->datasize) {
+					err = -EINVAL;
+					goto out;
+				}
+
 	return 0;
 out:
 	if (err) {