diff --git a/sys/dev/drm/radeon/radeon_vce.c b/sys/dev/drm/radeon/radeon_vce.c
index 1111111..2222222 100644
--- a/sys/dev/drm/radeon/radeon_vce.c
+++ b/sys/dev/drm/radeon/radeon_vce.c
@@ -557,6 +557,13 @@ int radeon_vce_cs_parse(struct radeon_cs_parser *p)
 	uint32_t tmp, handle = 0;
 	uint32_t *size = &tmp;
 	int i, r = 0;
 
+	/* DF-4608: a CS without a RADEON_CHUNK_ID_RELOCS chunk leaves
+	 * p->chunk_relocs NULL (radeon_cs.c:313-315) and passes
+	 * radeon_cs_parser_relocs (radeon_cs.c:83-85 returns 0).  Every
+	 * radeon_vce_cs_reloc() call would then dereference NULL at
+	 * "idx >= relocs_chunk->length_dw" (radeon_vce.c:482).  Reject it
+	 * exactly like radeon_uvd_cs_parse() does (radeon_uvd.c:705-709).
+	 */
+	if (p->chunk_relocs == NULL) {
+		DRM_ERROR("No relocation chunk !\n");
+		return -EINVAL;
+	}
+
 	while (p->idx < p->chunk_ib->length_dw) {
 		uint32_t len = radeon_get_ib_value(p, p->idx);
 		uint32_t cmd = radeon_get_ib_value(p, p->idx + 1);