--- sys/dev/drm/include/drm/drm_mm.h	2026-09-21 02:30:20.525459746 +0000
+++ sys/dev/drm/include/drm/drm_mm.h	2026-09-21 02:30:20.549459437 +0000
@@ -492,13 +492,12 @@
  * but using the internal interval tree to accelerate the search for the
  * starting node, and so not safe against removal of elements. It assumes
  * that @end is within (or is the upper limit of) the drm_mm allocator.
- * If [@start, @end] are beyond the range of the drm_mm, the iterator may walk
- * over the special _unallocated_ &drm_mm.head_node, and may even continue
- * indefinitely.
+ * The iterator stops at the special _unallocated_ &drm_mm.head_node, so it
+ * is safe to use with an @end past the end of the drm_mm allocator.
  */
 #define drm_mm_for_each_node_in_range(node__, mm__, start__, end__)	\
 	for (node__ = __drm_mm_interval_first((mm__), (start__), (end__)-1); \
-	     node__->start < (end__);					\
+	     node__ != &(mm__)->head_node && node__->start < (end__);	\
 	     node__ = list_next_entry(node__, node_list))
 
 void drm_mm_scan_init_with_range(struct drm_mm_scan *scan,
--- sys/dev/drm/i915/i915_gem_evict.c	2026-09-21 02:30:20.525459746 +0000
+++ sys/dev/drm/i915/i915_gem_evict.c	2026-09-21 02:30:20.549459437 +0000
@@ -308,6 +308,12 @@
 
 		/* Always look at the page afterwards to avoid the end-of-GTT */
 		end += I915_GTT_PAGE_SIZE;
+
+		/* But never look past the end of the address space: the
+		 * drm_mm head_node sentinel is not an evictable vma and
+		 * drm_mm_for_each_node_in_range would hand it to us. */
+		if (end > vm->total)
+			end = vm->total;
 	}
 	GEM_BUG_ON(start >= end);