--- a/sys/dev/drm/i915/intel_csr.c
+++ b/sys/dev/drm/i915/intel_csr.c
@@ -349,6 +349,12 @@
 	}
 	readcount += sizeof(struct intel_package_header);
 
+	if (package_header->num_entries > ARRAY_SIZE(package_header->fw_info)) {
+		DRM_ERROR("DMC firmware has too many package entries %u\n",
+			  package_header->num_entries);
+		return NULL;
+	}
+
 	/* Search for dmc_offset to find firware binary. */
 	for (i = 0; i < package_header->num_entries; i++) {
 		if (package_header->fw_info[i].substepping == '*' &&