--- a/sys/dev/drm/amd/display/dc/dce100/dce100_resource.c
+++ b/sys/dev/drm/amd/display/dc/dce100/dce100_resource.c
@@ -567,6 +567,25 @@
 	if (!enc110)
 		return NULL;
 
+	/*
+	 * DF-4495 (DF-4312/4319/4352/4375 family): transmitter/channel/
+	 * hpd_source come from the VBIOS object tables and can legally hold
+	 * UNKNOWN or values beyond the const register tables (7/6/6 entries).
+	 * An OOB lookup yields a garbage MMIO register base that every later
+	 * register access on this encoder dereferences.  Bounds-check and let
+	 * the caller (dc_link.c:1187-1190) fail this link cleanly.
+	 */
+	if (enc_init_data->transmitter < TRANSMITTER_UNIPHY_A
+	 || enc_init_data->transmitter > TRANSMITTER_NUTMEG_CRT
+	 || enc_init_data->channel < CHANNEL_ID_DDC1
+	 || enc_init_data->channel > CHANNEL_ID_DDC6
+	 || enc_init_data->hpd_source < HPD_SOURCEID1
+	 || enc_init_data->hpd_source > HPD_SOURCEID6) {
+		kfree(enc110);
+		BREAK_TO_DEBUGGER();
+		return NULL;
+	}
+
 	dce110_link_encoder_construct(enc110,
 				      enc_init_data,
 				      &link_enc_feature,