diff --git a/sys/dev/drm/amd/amdgpu/ci_smc.c b/sys/dev/drm/amd/amdgpu/ci_smc.c
@@ -229,6 +229,13 @@
 	if (ucode_size & 3)
 		return -EINVAL;
 
+	/* Validate firmware header fields against the blob and SMC RAM */
+	if (le32_to_cpu(hdr->header.ucode_array_offset_bytes) +
+	    ucode_size > adev->pm.fw->datasize)
+		return -EINVAL;
+	if (ucode_start_address + ucode_size > limit)
+		return -EINVAL;
+
 	spin_lock_irqsave(&adev->smc_idx_lock, flags);
 	WREG32(mmSMC_IND_INDEX_0, ucode_start_address);
 	WREG32_P(mmSMC_IND_ACCESS_CNTL, SMC_IND_ACCESS_CNTL__AUTO_INCREMENT_IND_0_MASK,