--- a/sys/dev/drm/amd/amdgpu/amdgpu_pm.c	2026-09-19 00:00:00.000000000 +0000
+++ b/sys/dev/drm/amd/amdgpu/amdgpu_pm.c	2026-09-19 00:00:00.000000000 +0000
@@ -942,6 +942,7 @@
 		while (isspace(*++buf))
 			i++;
 		memcpy(buf_cpy, buf, count-i);
+		buf_cpy[count-i] = '\0';	/* explicit termination */
 		tmp_str = buf_cpy;
 		while (tmp_str[0]) {
 			sub_str = strsep(&tmp_str, delimiter);
@@ -951,7 +952,16 @@
 				goto fail;
 			}
 			parameter_size++;
-			while (isspace(*tmp_str))
+			if (parameter_size >= sizeof(parameter)/sizeof(parameter[0])) {
+				count = -EINVAL;
+				goto fail;
+			}
+			/*
+			 * strsep() sets *stringp to NULL when the remainder
+			 * held no delimiter (write not terminated by ' ' or
+			 * '\n'); never dereference it.
+			 */
+			while (tmp_str != NULL && isspace(*tmp_str))
 				tmp_str++;
 		}
 	}