--- a/sys/dev/drm/amd/amdgpu/atom.c	2026-09-19 15:20:12.546995756 +0000
+++ b/sys/dev/drm/amd/amdgpu/atom.c	2026-09-19 15:20:12.558995603 +0000
@@ -1284,11 +1284,20 @@
 	ctx->iio = kzalloc(2 * 256, GFP_KERNEL);
 	if (!ctx->iio)
 		return;
-	while (CU8(base) == ATOM_IIO_START) {
+	/* opcode bytes come from the VBIOS: they index the 10-entry
+	 * atom_iio_len[] table and drive the walk pointer -- bound both */
+	while (base >= 0 && base + 2 <= ctx->bios_size &&
+	       CU8(base) == ATOM_IIO_START) {
 		ctx->iio[CU8(base + 1)] = base + 2;
 		base += 2;
-		while (CU8(base) != ATOM_IIO_END)
-			base += atom_iio_len[CU8(base)];
+		while (base >= 0 && base + 1 <= ctx->bios_size &&
+		       CU8(base) != ATOM_IIO_END) {
+			int op = CU8(base);
+
+			if (op > ATOM_IIO_END)
+				return;
+			base += atom_iio_len[op];
+		}
 		base += 3;
 	}
 }