Requires the bios_size plumbing described in DF-3744's fix.diff (ctx->bios_size).
Guard example for the record-pointer dereferences:

--- a/sys/dev/drm/radeon/radeon_atombios.c
+++ b/sys/dev/drm/radeon/radeon_atombios.c
@@ -651,6 +651,12 @@ bool radeon_get_atom_connector_info_from_object_table(struct drm_device *dev)
 				if (grph_obj_type == GRAPH_OBJECT_TYPE_ENCODER) {
 					for (k = 0; k < enc_obj->ucNumberOfObjects; k++) {
 						u16 encoder_obj = le16_to_cpu(enc_obj->asObjects[k].usObjectID);
 						if (le16_to_cpu(path->usGraphicObjIds[j]) == encoder_obj) {
+							u16 roff = le16_to_cpu(enc_obj->asObjects[k].usRecordOffset);
+							if ((u32)data_offset + roff + sizeof(ATOM_COMMON_RECORD_HEADER) >
+							    mode_info->atom_context->bios_size)
+								continue;
 							ATOM_COMMON_RECORD_HEADER *record = (ATOM_COMMON_RECORD_HEADER *)
 								(ctx->bios + data_offset + roff);
(the same pattern applies to :685-698 and the ucMuxState[enum_id] reads need enum_id < ARRAY_SIZE bounds)