--- a/sys/dev/drm/radeon/ci_dpm.c
+++ b/sys/dev/drm/radeon/ci_dpm.c
@@ -2150,6 +2150,11 @@ static int ci_get_svi2_voltage_table(struct radeon_device *rdev,
 	u32 i;
 
 	if (voltage_dependency_table == NULL)
 		return -EINVAL;
+	/* entries[] is fixed at MAX_VOLTAGE_ENTRIES (32); the state-table trim
+	 * happens only after this copy, so bound the source count here. */
+	if (voltage_dependency_table->count > MAX_VOLTAGE_ENTRIES) {
+		DRM_ERROR("SVI2 voltage dependency table too large\n");
+		return -EINVAL;
+	}
 
 	voltage_table->mask_low = 0;
 	voltage_table->phase_delay = 0;