--- a/sys/dev/drm/amd/display/dc/dcn10/dcn10_resource.c
+++ b/sys/dev/drm/amd/display/dc/dcn10/dcn10_resource.c
@@ -738,6 +738,22 @@
 	if (!enc10)
 		return NULL;
 
+	/* All three indices come from the GPU's object tables (VBIOS):
+	 * reject anything outside the register tables instead of doing
+	 * an out-of-bounds const-array read that would later be used as
+	 * a register base for MMIO. */
+	if ((unsigned int)enc_init_data->transmitter >=
+			ARRAY_SIZE(link_enc_regs) ||
+	    enc_init_data->channel < 1 ||
+	    (unsigned int)(enc_init_data->channel - 1) >=
+			ARRAY_SIZE(link_enc_aux_regs) ||
+	    (unsigned int)enc_init_data->hpd_source >=
+			ARRAY_SIZE(link_enc_hpd_regs)) {
+		kfree(enc10);
+		BREAK_TO_DEBUGGER();
+		return NULL;
+	}
+
 	dcn10_link_encoder_construct(enc10,
 				      enc_init_data,
 				      &link_enc_feature,