--- a/sys/dev/drm/amd/display/dc/i2caux/i2c_generic_hw_engine.c
+++ b/sys/dev/drm/amd/display/dc/i2caux/i2c_generic_hw_engine.c
@@ -105,6 +105,21 @@
 
 	bool result = false;
 
+	/* The chunking math below needs room for at least one payload byte
+	 * next to the slave address.  With max_payload_size == 0 the
+	 * expression 'max_payload_size - 1' at the first-iteration branch
+	 * underflows to 0xffffffff and bypasses chunking entirely (DF-2090);
+	 * with max_payload_size == 1 the first sub-transaction degenerates to
+	 * a zero-payload address-only transaction and every following chunk
+	 * is sent as an unaddressed 1-byte transaction (start_bit = 0).
+	 * Both are nonsense transfers; fail the request cleanly instead.
+	 */
+	if (max_payload_size < 2) {
+		i2caux_request->status =
+			I2CAUX_TRANSACTION_STATUS_FAILED_BUFFER_OVERFLOW;
+		return false;
+	}
+
 	/* setup transaction initial properties */
 
 	uint8_t address = i2caux_request->payload.address;