The kernel does not track the BIOS image length (struct atom_context has no bios_size), so a
correct bound needs minimal plumbing: radeon_bios.c already knows the size at each rdev->bios
allocation; store it in rdev->bios_size (radeon.h), pass it into atom_parse() (atom.c:1270) and keep
it in ctx->bios_size (atom.h:125-140). Then:

--- a/sys/dev/drm/radeon/radeon_atombios.c
+++ b/sys/dev/drm/radeon/radeon_atombios.c
@@ -1706,7 +1706,10 @@ struct radeon_encoder_atom_dig *radeon_atombios_get_lvds_info(struct
 			else
 				/* relative */
 				record = (u8 *)(mode_info->atom_context->bios +
-						data_offset +
-						le16_to_cpu(lvds_info->info.usModePatchTableOffset));
-			while (*record != ATOM_RECORD_END_TYPE) {
+						data_offset +
+						le16_to_cpu(lvds_info->info.usModePatchTableOffset));
+			while (*record != ATOM_RECORD_END_TYPE &&
+			       (record < (u8 *)mode_info->atom_context->bios +
+					  mode_info->atom_context->bios_size)) {
 				switch (*record) {