--- a/sys/dev/drm/drm_dp_mst_topology.c	2026-09-16 21:03:55.846742995 +0000
+++ b/sys/dev/drm/drm_dp_mst_topology.c	2026-09-16 21:04:11.754541465 +0000
@@ -371,6 +371,19 @@
 	if (msg->curchunk_idx >= msg->curchunk_len) {
 		/* do CRC */
 		crc4 = drm_dp_msg_data_crc4(msg->chunk, msg->curchunk_len - 1);
+		/*
+		 * curchunk_len is hub-controlled (6 bits, <= 63) and curlen
+		 * (u8) has never been validated: without this bound a reply
+		 * longer than 256 bytes (e.g. a 15-port LINK_ADDRESS ACK)
+		 * appends up to 61 hub-controlled bytes past msg->msg[256]
+		 * into curlen/have_*/initial_hdr and the adjacent
+		 * up_req_recv.
+		 */
+		if ((int)msg->curlen + (int)msg->curchunk_len - 1 >
+		    (int)sizeof(msg->msg)) {
+			DRM_DEBUG_KMS("sideband msg overflows msg buffer\n");
+			return false;
+		}
 		/* copy chunk into bigger msg */
 		memcpy(&msg->msg[msg->curlen], msg->chunk, msg->curchunk_len - 1);
 		msg->curlen += msg->curchunk_len - 1;