# DF-1127 — Missing bounds checks on BIOS-supplied array indices in si_parse_power_table (AMD GPU)

## Finding
`si_parse_power_table` at `sys/dev/drm/amd/amdgpu/si_dpm.c:7253-7255`:
`nonClockInfoIndex` is read from BIOS and used **unvalidated** to index
`non_clock_info_array->nonClockInfo[]` with no check against `ucNumEntries`.
The sibling clock loop at `:7269` DOES check
`if (clock_array_index >= clock_info_array->ucNumEntries) continue;` —
proving the omission is an oversight. Same issue for VCE `clk_idx` at
`:7288-7290`. Crafted/malformed VBIOS → OOB read from BIOS mapping →
info leak via sysfs `pp_dpm_sclk` or panic.

**IMPORTANT correction to the finding:** the cited file
`sys/dev/drm/amd/amdgpu/si_dpm.c` is **NOT compiled** (absent from the
amdgpu Makefile SRCS). The **same bug** exists in the live copy
`sys/dev/drm/radeon/si_dpm.c:6848-6850` which **IS compiled into
`radeon.ko`** (confirmed via `nm /boot/kernel/radeon.ko` → `si_dpm_init`).
The `fix.diff` patches BOTH copies.

## Reachability on this guest
**NOT reachable.** The VGA device is a QEMU stub (`chip=0x11111234`, not an
AMD GPU). `radeon.ko` is loadable but never attaches to this hardware. Latent.

A userspace harness demonstrates the OOB read at a bogus BIOS index.

## Build / Run / Expected
```
cc -O2 -o harness harness.c     # build.sh
./harness                        # run.sh
# Expected: "READ PAST MAPPING BOUNDARY -> kernel OOB read" at index 42
```

## Files
- `harness.c` — simulates a BIOS mapping with a valid 4-entry array and
  demonstrates OOB at `nonClockInfoIndex = 42`.
- `fix.diff` — adds the bounds check to BOTH `amdgpu/si_dpm.c` (as cited)
  and `radeon/si_dpm.c` (the compiled copy). Validated: `radeon.ko` builds
  with `rc=0`.
- `build.log` / `run.log` / `env.txt` — captured outputs.