# DF-1138 — radeon/si_dpm.c VCE-state fill-in OOB read

## TL;DR
- **Status: REPRODUCED (source + harness).** The VCE-state fill-in loop
  in `si_parse_power_table` reads `clockInfo[clk_idx*ucEntrySize]` from
  a BIOS-controlled `clk_idx` WITHOUT the bounds check that protects the
  main power-state loop one screen above. Up to ~1 KB OOB read of the
  BIOS mapping, exfiltrated to userspace via `radeon_pm_info`.
- **Impact: info leak / panic.**

## Why no live trigger on this guest
Bug is in `radeon.ko`. The QEMU audit guest has no AMD GPU.

## Files
- `harness.c` — constructs a crafted `clockInfoArray` and a `clk_idx=0x3f`
  to demonstrate the OOB read and the fix's rejection.
- `fix.diff` — adds the missing `ucNumEntries` bounds check in the VCE
  loop, mirroring the existing main-loop guard.
- `run.log`, `env.txt`.

## Reproduce
```
./build.sh && ./run.sh
```
Expected: harness shows main-loop rejecting the OOB `clk_idx`, the buggy
VCE-loop reading byte `0xab` at offset 1008 (928 bytes OOB), and the
fixed VCE-loop rejecting.

## Fix validation
`fix.diff` applied; `radeon.ko` rebuilt cleanly (2,029,432 bytes).