--- a/sys/dev/drm/amd/display/dc/dc_types.h
+++ b/sys/dev/drm/amd/display/dc/dc_types.h
@@ -71,6 +71,7 @@
 	uint32_t feature_flags;
 	uint32_t fake_paths_num;
 	void *atombios_base_address;
+	uint32_t atombios_size;
 };
 
 struct dc_context {
--- a/sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -410,6 +410,8 @@
 	init_data.asic_id.atombios_base_address =
 		adev->mode_info.atom_context->bios;
 
+	init_data.asic_id.atombios_size = adev->bios_size;
+
 	init_data.driver = adev;
 
 	adev->dm.cgs_device = amdgpu_cgs_create_device(adev);
--- a/sys/dev/drm/amd/display/include/bios_parser_interface.h
+++ b/sys/dev/drm/amd/display/include/bios_parser_interface.h
@@ -33,6 +33,7 @@
 struct bp_init_data {
 	struct dc_context *ctx;
 	uint8_t *bios;
+	uint32_t bios_size;
 };
 
 struct dc_bios *dal_bios_parser_create(
--- a/sys/dev/drm/amd/display/dc/core/dc.c
+++ b/sys/dev/drm/amd/display/dc/core/dc.c
@@ -637,6 +637,7 @@
 
 		bp_init_data.ctx = dc_ctx;
 		bp_init_data.bios = init_params->asic_id.atombios_base_address;
+		bp_init_data.bios_size = init_params->asic_id.atombios_size;
 
 		dc_ctx->dc_bios = dal_bios_parser_create(
 				&bp_init_data, dc_version);
--- a/sys/dev/drm/amd/display/dc/bios/bios_parser2.c
+++ b/sys/dev/drm/amd/display/dc/bios/bios_parser2.c
@@ -1927,7 +1927,12 @@
 
 	bp->base.funcs = &vbios_funcs;
 	bp->base.bios = init->bios;
-	bp->base.bios_size = bp->base.bios[OFFSET_TO_ATOM_ROM_IMAGE_SIZE] * BIOS_IMAGE_SIZE_UNIT;
+	bp->base.bios_size =
+		bp->base.bios[OFFSET_TO_ATOM_ROM_IMAGE_SIZE] * BIOS_IMAGE_SIZE_UNIT;
+	/* the image-size byte is VBIOS-controlled; never trust it beyond the
+	 * buffer actually allocated by the driver (adev->bios_size) */
+	if (init->bios_size && bp->base.bios_size > init->bios_size)
+		bp->base.bios_size = init->bios_size;
 
 	bp->base.ctx = init->ctx;