--- a/sys/dev/drm/radeon/evergreen_cs.c
+++ b/sys/dev/drm/radeon/evergreen_cs.c
@@ -2413,9 +2413,12 @@
 				}
 				offset = radeon_get_ib_value(p, idx+1+(i*8)+0);
 				size = radeon_get_ib_value(p, idx+1+(i*8)+1);
-				if (p->rdev && (size + offset) > radeon_bo_size(reloc->robj)) {
+				if (p->rdev &&
+				    ((uint64_t)size + offset) > radeon_bo_size(reloc->robj)) {
 					/* force size to size of the buffer */
 					dev_warn(p->dev, "vbo resource seems too big for the bo\n");
+					if (offset >= radeon_bo_size(reloc->robj))
+						return -EINVAL;
 					ib[idx+1+(i*8)+1] = radeon_bo_size(reloc->robj) - offset;
 				}