--- a/r600_hdmi.c
+++ b/r600_hdmi.c
@@ -283,6 +283,15 @@
 	struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
 	int status, result;
 
+	/*
+	 * enc_priv is only a radeon_encoder_atom_dig for encoders
+	 * registered as DRM_MODE_ENCODER_TMDS; LCD-carrying digital
+	 * encoders carry a radeon_encoder_lvds (280 bytes) instead and
+	 * dig->afmt (+288) would read past the object (DF-4828).
+	 */
+	if (!dig || encoder->encoder_type != DRM_MODE_ENCODER_TMDS)
+		return 0;
+
 	if (!dig->afmt || !dig->afmt->enabled)
 		return 0;
 
@@ -430,6 +439,10 @@
 	uint32_t value;
 	ssize_t err;
 
+	/* see r600_hdmi_buffer_status_changed(): enc_priv type gate (DF-4828) */
+	if (!dig || encoder->encoder_type != DRM_MODE_ENCODER_TMDS)
+		return;
+
 	if (!dig->afmt || !dig->afmt->enabled)
 		return;
 	offset = dig->afmt->offset;