--- a/sys/dev/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c
+++ b/sys/dev/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v9.c
@@ -374,6 +374,10 @@ static uint32_t get_sdma_base_addr(struct amdgpu_device *adev,
 				mmSDMA1_RLC0_RB_CNTL) - mmSDMA1_RLC0_RB_CNTL
 	};
 	uint32_t retval;
 
+	/* engine_id comes from the MQD; do not trust the (currently absent)
+	 * kfd frontend to have validated it. */
+	if (engine_id >= 2)
+		return 0;
+
 	retval = base[engine_id] + queue_id * (mmSDMA0_RLC1_RB_CNTL -
 					       mmSDMA0_RLC0_RB_CNTL);
 
@@ -291,6 +295,11 @@ static int kgd_set_pasid_vmid_mapping(struct kgd_dev *kgd, unsigned int pasid,
 	struct amdgpu_device *adev = get_amdgpu_device(kgd);
 
+	/* ATC_VMID0..15 and the IH LUTs are 16 entries; a larger vmid would
+	 * walk into unrelated registers and shift >= 32 is UB. */
+	if (vmid >= 16)
+		return -EINVAL;
+
 	/*
 	 * We have to assume that there is no outstanding mapping.
 	 * The ATC_VMID_PASID_MAPPING_UPDATE_STATUS bit could be 0 because