--- sys/dev/drm/radeon/r300.c
+++ sys/dev/drm/radeon/r300.c
@@ -1078,6 +1078,12 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
 		case R300_ZB_ZPASS_ADDR:
 			r = radeon_cs_packet_next_reloc(p, &reloc, 0);
 			if (r) {
 				DRM_ERROR("No reloc for ib[%d]=0x%04X\n",
 					  idx, reg);
 				radeon_cs_dump_packet(p, pkt);
 				return r;
 			}
+			/* The Z-pass (occlusion) counter unit writes at
+			 * gpu_offset + idx_value; idx_value must stay inside
+			 * the relocation target BO like every other
+			 * address-bearing register we track. */
+			if ((u64)idx_value + 8 > radeon_bo_size(reloc->robj)) {
+				DRM_ERROR("ZB_ZPASS_ADDR offset %u exceeds BO size\n",
+					  idx_value);
+				return -EINVAL;
+			}
 			ib[idx] = idx_value + ((u32)reloc->gpu_offset);
 			break;