--- a/sys/dev/drm/radeon/r600_cs.c
+++ b/sys/dev/drm/radeon/r600_cs.c
@@ -1999,10 +1999,15 @@
 				}
 				offset = radeon_get_ib_value(p, idx+1+(i*7)+0);
 				size = radeon_get_ib_value(p, idx+1+(i*7)+1) + 1;
-				if (p->rdev && (size + offset) > radeon_bo_size(reloc->robj)) {
+				if (p->rdev && ((u64)size + (u64)offset) > radeon_bo_size(reloc->robj)) {
+					if (offset >= radeon_bo_size(reloc->robj)) {
+						dev_warn(p->dev, "vbo resource offset too big (%d %ld)\n",
+							 offset, radeon_bo_size(reloc->robj));
+						return -EINVAL;
+					}
 					/* force size to size of the buffer */
-					dev_warn(p->dev, "vbo resource seems too big (%d) for the bo (%ld)\n",
-						 size + offset, radeon_bo_size(reloc->robj));
+					dev_warn(p->dev, "vbo resource seems too big (%d %d) for the bo (%ld)\n",
+						 size, offset, radeon_bo_size(reloc->robj));
 					ib[idx+1+(i*7)+1] = radeon_bo_size(reloc->robj) - offset;
 				}