--- a/sys/dev/drm/radeon/radeon_atombios.c
+++ b/sys/dev/drm/radeon/radeon_atombios.c
@@ -3938,6 +3938,11 @@ int radeon_atom_get_mclk_range_table(struct radeon_device *rdev,
 					mclk_range_table->num_entries = (u8)
 						((le16_to_cpu(vram_module->usModuleSize) - offsetof(ATOM_VRAM_MODULE_V4, asMemTiming)) /
 						 mem_timing_size);
+					if (mclk_range_table->num_entries > MAX_AC_TIMING_ENTRIES) {
+						DRM_ERROR("Invalid VRAM module timing count %d\n",
+							  mclk_range_table->num_entries);
+						return -EINVAL;
+					}
 					format = &vram_module->asMemTiming[0];
 					for (i = 0; i < mclk_range_table->num_entries; i++) {