--- a/sys/dev/drm/amd/amdgpu/amdgpu_uvd.c
+++ b/sys/dev/drm/amd/amdgpu/amdgpu_uvd.c
@@ -201,6 +201,21 @@
 		return r;
 	}
 
+	/* DF-1946 family: validate the ucode extent the loader consumes
+	 * (ucode_array_offset_bytes/ucode_size_bytes are otherwise trusted
+	 * by sw_init's bo_size and uvd_resume's memcpy_toio/memset_io). */
+	if ((uint64_t)le32_to_cpu(((const struct common_firmware_header *)
+			adev->uvd.fw->data)->ucode_array_offset_bytes) +
+	    le32_to_cpu(((const struct common_firmware_header *)
+			adev->uvd.fw->data)->ucode_size_bytes) >
+	    adev->uvd.fw->datasize) {
+		dev_err(adev->dev, "amdgpu_uvd: invalid firmware ucode extent \"%s\"\n",
+			fw_name);
+		release_firmware(adev->uvd.fw);
+		adev->uvd.fw = NULL;
+		return -EINVAL;
+	}
+
 	/* Set the default UVD handles that the firmware can handle */
 	adev->uvd.max_handles = AMDGPU_DEFAULT_UVD_HANDLES;