--- a/sys/dev/drm/radeon/evergreen_hdmi.c	2026-09-24 14:13:17.526117523 +0000
+++ b/sys/dev/drm/radeon/evergreen_hdmi.c	2026-09-24 14:13:26.693998927 +0000
@@ -428,6 +428,21 @@
 	struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
 	struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
 
+	/*
+	 * enc_priv is only a radeon_encoder_atom_dig for encoders NOT
+	 * registered as DRM_MODE_ENCODER_LVDS.  LCD-carrying digital
+	 * encoders (every eDP panel: UNIPHY* + ATOM_DEVICE_LCD_SUPPORT,
+	 * atombios_encoders.c:2862-2869, and TMDS1/LVTM1 with LCD support
+	 * at :2824-2836) carry a 280-byte radeon_encoder_lvds instead, and
+	 * dig->afmt (+288) reads 8 bytes past the object into the adjacent
+	 * slab chunk (DF-4853, DF-4635/DF-4828 family).  eDP connectors
+	 * pass the encoder_mode==HDMI||IS_DP gate at
+	 * atombios_encoders.c:1848-1851, so this dpms path IS reachable
+	 * with the mis-typed enc_priv.
+	 */
+	if (!dig || encoder->encoder_type == DRM_MODE_ENCODER_LVDS)
+		return;
+
 	if (!dig || !dig->afmt)
 		return;
 
@@ -470,6 +485,10 @@
 	struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
 	struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
 
+	/* see evergreen_hdmi_enable(): enc_priv type gate (DF-4853) */
+	if (!dig || encoder->encoder_type == DRM_MODE_ENCODER_LVDS)
+		return;
+
 	if (!dig || !dig->afmt)
 		return;