diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_userq.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_userq.c
index 835486f634e..38a21cab03c 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_userq.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_userq.c
@@ -358,6 +358,13 @@ amdgpu_userq_get_doorbell_index(struct amdgpu_userq_mgr *uq_mgr,
 		goto unpin_bo;
 	}
 
+	/* Validate doorbell_offset is within the doorbell BO */
+	if ((u64)db_info->doorbell_offset * db_size + db_size >
+	    amdgpu_bo_size(db_obj->obj)) {
+		r = -EINVAL;
+		goto unpin_bo;
+	}
+
 	index = amdgpu_doorbell_index_on_bar(uq_mgr->adev, db_obj->obj,
 					     db_info->doorbell_offset, db_size);
 	drm_dbg_driver(adev_to_drm(uq_mgr->adev),