--- a/sys/dev/drm/amd/display/dc/i2caux/dce110/i2caux_dce110.c	2026-09-26 06:51:12.857551787 +0000
+++ b/sys/dev/drm/amd/display/dc/i2caux/dce110/i2caux_dce110.c	2026-09-26 06:51:39.593203294 +0000
@@ -209,6 +209,12 @@
 	const struct dce110_i2c_hw_engine_mask *i2c_mask)
 {
 	uint32_t i = 0;
+
+	/* hw_ddc_lines/hw_aux_lines below are callee-static (6 entries):
+	 * never let a caller-supplied count walk past them. */
+	if (num_i2caux_inst > ARRAY_SIZE(hw_ddc_lines))
+		num_i2caux_inst = ARRAY_SIZE(hw_ddc_lines);
+
 	uint32_t reference_frequency = 0;
 	bool use_i2c_sw_engine = false;
 	struct i2caux *base = NULL;