--- a/sys/dev/drm/radeon/atom.c
+++ b/sys/dev/drm/radeon/atom.c
@@ -1261,8 +1261,16 @@
 	while (CU8(base) == ATOM_IIO_START) {
 		ctx->iio[CU8(base + 1)] = base + 2;
 		base += 2;
-		while (CU8(base) != ATOM_IIO_END)
-			base += atom_iio_len[CU8(base)];
+		while (CU8(base) != ATOM_IIO_END) {
+			int op = CU8(base);
+
+			/* atom_iio_len[] has 10 entries (ATOM_IIO_NOP..
+			 * ATOM_IIO_END); an unvalidated VBIOS opcode byte
+			 * would index far past it */
+			if (op > ATOM_IIO_END)
+				return;
+			base += atom_iio_len[op];
+		}
 		base += 3;
 	}
 }