--- a/sys/dev/drm/amd/display/dc/dce110/dce110_resource.c
+++ b/sys/dev/drm/amd/display/dc/dce110/dce110_resource.c
@@ -582,6 +582,25 @@
 	if (!enc110)
 		return NULL;
 
+	/*
+	 * DF-4352 (DF-4312/4319 family): transmitter/channel/hpd_source come
+	 * from the VBIOS object tables and can legally hold UNKNOWN or
+	 * values beyond the const register tables (7/6/6 entries).  An OOB
+	 * lookup yields a garbage MMIO register base that every later
+	 * register access on this encoder dereferences.  Bounds-check and
+	 * let the caller (dc_link.c link construct) fail this link cleanly.
+	 */
+	if (enc_init_data->transmitter < TRANSMITTER_UNIPHY_A
+	 || enc_init_data->transmitter > TRANSMITTER_NUTMEG_CRT
+	 || enc_init_data->channel < CHANNEL_ID_DDC1
+	 || enc_init_data->channel > CHANNEL_ID_DDC6
+	 || enc_init_data->hpd_source < HPD_SOURCEID1
+	 || enc_init_data->hpd_source > HPD_SOURCEID6) {
+		kfree(enc110);
+		BREAK_TO_DEBUGGER();
+		return NULL;
+	}
+
 	dce110_link_encoder_construct(enc110,
 				      enc_init_data,
 				      &link_enc_feature,