--- a/sys/dev/drm/amd/amdgpu/amdgpu_vm.c
+++ b/sys/dev/drm/amd/amdgpu/amdgpu_vm.c
@@ -1804,7 +1804,11 @@
 {
 	struct amdgpu_ring *ring;
 	void *owner = AMDGPU_FENCE_OWNER_VM;
-	unsigned nptes, ncmds, ndw;
+	/* DF-3863: last-start+1 must not be truncated to 32 bits: a mapping
+	 * spanning >= 2^32 GPU pages wraps nptes, undersizes the IB and
+	 * amdgpu_vm_update_ptes then writes past its end.
+	 */
+	uint64_t nptes, ncmds, ndw;
 	struct amdgpu_job *job;
 	struct amdgpu_pte_update_params params;
 	struct dma_fence *f = NULL;
@@ -1876,7 +1880,8 @@
 		params.func = amdgpu_vm_do_set_ptes;
 	}
 
-	r = amdgpu_job_alloc_with_ib(adev, ndw * 4, &job);
+	r = amdgpu_job_alloc_with_ib(
+		adev, min(ndw * 4, (uint64_t)UINT_MAX), &job);
 	if (r)
 		return r;