--- a/sys/dev/drm/radeon/uvd_v1_0.c	2026-09-24 08:53:38.350697710 +0000
+++ b/sys/dev/drm/radeon/uvd_v1_0.c	2026-09-24 08:53:43.454631619 +0000
@@ -119,7 +119,14 @@
 
 	/* programm the VCPU memory controller bits 0-27 */
 	addr = (rdev->uvd.gpu_addr >> 3) + 16;
-	size = RADEON_GPU_PAGE_ALIGN(rdev->uvd_fw->datasize) >> 3;
+	/*
+	 * The code window starts 128 bytes into vcpu_bo (jump over the fw
+	 * header), so it must end 128 bytes earlier as well: vcpu_bo is
+	 * sized RADEON_GPU_PAGE_ALIGN(datasize + 8) + HEAP + STACK +
+	 * SESSION*N in radeon_uvd.c; with the old size the STACK/SESSION
+	 * window ended exactly 128 bytes past the end of the bo (DF-4832).
+	 */
+	size = (RADEON_GPU_PAGE_ALIGN(rdev->uvd_fw->datasize + 8) >> 3) - 16;
 	WREG32(UVD_VCPU_CACHE_OFFSET0, addr);
 	WREG32(UVD_VCPU_CACHE_SIZE0, size);