--- a/sys/dev/drm/radeon/sumo_dpm.c
+++ b/sys/dev/drm/radeon/sumo_dpm.c
@@ -1518,6 +1518,21 @@
 						    clock_info);
 			k++;
 		}
+		/* DF-4189: a pplib state with ucNumDPMLevels == 0 would leave
+		 * ps->num_levels == 0; every later levels[num_levels - 1]
+		 * access (sumo_set_uvd_clock_*_set_eng_clock, sumo_program_bsp,
+		 * sumo_dpm_get_sclk) then reads levels[0xffffffff], ~96 GB
+		 * past the allocation.  Reject the table instead. */
+		if (k == 0) {
+			DRM_ERROR("power state %d has no DPM levels\n", i);
+			kfree(ps);
+			rdev->pm.dpm.ps[i].ps_priv = NULL;
+			for (i--; i >= 0; i--)
+				kfree(rdev->pm.dpm.ps[i].ps_priv);
+			kfree(rdev->pm.dpm.ps);
+			rdev->pm.dpm.ps = NULL;
+			return -EINVAL;
+		}
 		sumo_parse_pplib_non_clock_info(rdev, &rdev->pm.dpm.ps[i],
 						non_clock_info,
 						non_clock_info_array->ucEntrySize);