--- a/sys/dev/drm/i915/intel_dp.c
+++ b/sys/dev/drm/i915/intel_dp.c
@@ -859,8 +859,15 @@ bxt_power_sequencer_idx(struct intel_dp *intel_dp)
 	lockdep_assert_held(&dev_priv->pps_mutex);
 
 	/* We should never land here with regular DP ports */
 	WARN_ON(!intel_dp_is_edp(intel_dp));
 
+	/*
+	 * The VBT-supplied controller number is a raw byte from firmware
+	 * (valid hardware values are 0 and 1). Clamp it so a corrupt or
+	 * malicious VBT cannot redirect PPS register accesses outside the
+	 * two-entry power sequencer block.
+	 */
+	backlight_controller = min(backlight_controller, 1);
+
 	if (!intel_dp->pps_reset)
 		return backlight_controller;
 
 	intel_dp->pps_reset = false;