--- a/sys/dev/drm/amd/amdgpu/amdgpu_object.c	2026-06-29 12:51:18.000000000 +0000
+++ b/sys/dev/drm/amd/amdgpu/amdgpu_object.c	2026-09-19 18:43:15.902803486 +0000
@@ -139,74 +139,88 @@
 	if (domain & AMDGPU_GEM_DOMAIN_VRAM) {
 		unsigned visible_pfn = adev->gmc.visible_vram_size >> PAGE_SHIFT;
 
-		places[c].fpfn = 0;
-		places[c].lpfn = 0;
-		places[c].flags = TTM_PL_FLAG_WC | TTM_PL_FLAG_UNCACHED |
-			TTM_PL_FLAG_VRAM;
-
-		if (flags & AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED)
-			places[c].lpfn = visible_pfn;
-		else
-			places[c].flags |= TTM_PL_FLAG_TOPDOWN;
-
-		if (flags & AMDGPU_GEM_CREATE_VRAM_CONTIGUOUS)
-			places[c].flags |= TTM_PL_FLAG_CONTIGUOUS;
-		c++;
+		if (c < AMDGPU_BO_MAX_PLACEMENTS) {
+			places[c].fpfn = 0;
+			places[c].lpfn = 0;
+			places[c].flags = TTM_PL_FLAG_WC | TTM_PL_FLAG_UNCACHED |
+				TTM_PL_FLAG_VRAM;
+
+			if (flags & AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED)
+				places[c].lpfn = visible_pfn;
+			else
+				places[c].flags |= TTM_PL_FLAG_TOPDOWN;
+
+			if (flags & AMDGPU_GEM_CREATE_VRAM_CONTIGUOUS)
+				places[c].flags |= TTM_PL_FLAG_CONTIGUOUS;
+			c++;
+		}
 	}
 
 	if (domain & AMDGPU_GEM_DOMAIN_GTT) {
-		places[c].fpfn = 0;
-		places[c].lpfn = 0;
-		places[c].flags = TTM_PL_FLAG_TT;
-		if (flags & AMDGPU_GEM_CREATE_CPU_GTT_USWC)
-			places[c].flags |= TTM_PL_FLAG_WC |
-				TTM_PL_FLAG_UNCACHED;
-		else
-			places[c].flags |= TTM_PL_FLAG_CACHED;
-		c++;
+		if (c < AMDGPU_BO_MAX_PLACEMENTS) {
+			places[c].fpfn = 0;
+			places[c].lpfn = 0;
+			places[c].flags = TTM_PL_FLAG_TT;
+			if (flags & AMDGPU_GEM_CREATE_CPU_GTT_USWC)
+				places[c].flags |= TTM_PL_FLAG_WC |
+					TTM_PL_FLAG_UNCACHED;
+			else
+				places[c].flags |= TTM_PL_FLAG_CACHED;
+			c++;
+		}
 	}
 
 	if (domain & AMDGPU_GEM_DOMAIN_CPU) {
-		places[c].fpfn = 0;
-		places[c].lpfn = 0;
-		places[c].flags = TTM_PL_FLAG_SYSTEM;
-		if (flags & AMDGPU_GEM_CREATE_CPU_GTT_USWC)
-			places[c].flags |= TTM_PL_FLAG_WC |
-				TTM_PL_FLAG_UNCACHED;
-		else
-			places[c].flags |= TTM_PL_FLAG_CACHED;
-		c++;
+		if (c < AMDGPU_BO_MAX_PLACEMENTS) {
+			places[c].fpfn = 0;
+			places[c].lpfn = 0;
+			places[c].flags = TTM_PL_FLAG_SYSTEM;
+			if (flags & AMDGPU_GEM_CREATE_CPU_GTT_USWC)
+				places[c].flags |= TTM_PL_FLAG_WC |
+					TTM_PL_FLAG_UNCACHED;
+			else
+				places[c].flags |= TTM_PL_FLAG_CACHED;
+			c++;
+		}
 	}
 
 	if (domain & AMDGPU_GEM_DOMAIN_GDS) {
-		places[c].fpfn = 0;
-		places[c].lpfn = 0;
-		places[c].flags = TTM_PL_FLAG_UNCACHED | AMDGPU_PL_FLAG_GDS;
-		c++;
+		if (c < AMDGPU_BO_MAX_PLACEMENTS) {
+			places[c].fpfn = 0;
+			places[c].lpfn = 0;
+			places[c].flags = TTM_PL_FLAG_UNCACHED | AMDGPU_PL_FLAG_GDS;
+			c++;
+		}
 	}
 
 	if (domain & AMDGPU_GEM_DOMAIN_GWS) {
-		places[c].fpfn = 0;
-		places[c].lpfn = 0;
-		places[c].flags = TTM_PL_FLAG_UNCACHED | AMDGPU_PL_FLAG_GWS;
-		c++;
+		if (c < AMDGPU_BO_MAX_PLACEMENTS) {
+			places[c].fpfn = 0;
+			places[c].lpfn = 0;
+			places[c].flags = TTM_PL_FLAG_UNCACHED | AMDGPU_PL_FLAG_GWS;
+			c++;
+		}
 	}
 
 	if (domain & AMDGPU_GEM_DOMAIN_OA) {
-		places[c].fpfn = 0;
-		places[c].lpfn = 0;
-		places[c].flags = TTM_PL_FLAG_UNCACHED | AMDGPU_PL_FLAG_OA;
-		c++;
+		if (c < AMDGPU_BO_MAX_PLACEMENTS) {
+			places[c].fpfn = 0;
+			places[c].lpfn = 0;
+			places[c].flags = TTM_PL_FLAG_UNCACHED | AMDGPU_PL_FLAG_OA;
+			c++;
+		}
 	}
 
 	if (!c) {
-		places[c].fpfn = 0;
-		places[c].lpfn = 0;
-		places[c].flags = TTM_PL_MASK_CACHING | TTM_PL_FLAG_SYSTEM;
-		c++;
+		if (c < AMDGPU_BO_MAX_PLACEMENTS) {
+			places[c].fpfn = 0;
+			places[c].lpfn = 0;
+			places[c].flags = TTM_PL_MASK_CACHING | TTM_PL_FLAG_SYSTEM;
+			c++;
+		}
 	}
 
-	BUG_ON(c >= AMDGPU_BO_MAX_PLACEMENTS);
+	BUG_ON(c > AMDGPU_BO_MAX_PLACEMENTS);
 
 	placement->num_placement = c;
 	placement->placement = places;