--- a/sys/dev/drm/amd/display/dc/dce112/dce112_resource.c
+++ b/sys/dev/drm/amd/display/dc/dce112/dce112_resource.c
@@ -571,6 +571,26 @@
 	if (!enc110)
 		return NULL;
 
+	/*
+	 * DF-4375: transmitter / channel / hpd_source come from the VBIOS
+	 * object tables via dc_link.c construct() and can legally hold the
+	 * UNKNOWN(-1) sentinels or values beyond this ASIC's tables
+	 * (TRANSMITTER_UNIPHY_G/TRAVIS_*, CHANNEL_ID_DDC_VGA/I2C_PAD,
+	 * HPD_SOURCEID_UNKNOWN). Reject anything that would index past the
+	 * const register tables before the bogus register bases are stored
+	 * in the link encoder and dereferenced as MMIO offsets:
+	 *   link_enc_regs[7]     -> transmitter 0..6
+	 *   link_enc_aux_regs[6] -> channel DDC1..DDC6 (1..6)
+	 *   link_enc_hpd_regs[6] -> hpd_source HPD_SOURCEID1..6 (0..5)
+	 * (unsigned long cast also rejects the -1 UNKNOWN sentinels)
+	 */
+	if ((unsigned long)enc_init_data->transmitter >= ARRAY_SIZE(link_enc_regs) ||
+	    (unsigned long)(enc_init_data->channel - 1) >= ARRAY_SIZE(link_enc_aux_regs) ||
+	    (unsigned long)enc_init_data->hpd_source >= ARRAY_SIZE(link_enc_hpd_regs)) {
+		kfree(enc110);
+		return NULL;
+	}
+
 	dce110_link_encoder_construct(enc110,
 				      enc_init_data,
 				      &link_enc_feature,