# DF-1150 — PoC evidence pack

**Heap OOB write in `ci_setup_default_dpm_tables` (radeon `sys/dev/drm/radeon/ci_dpm.c:3514-3565`).**

`ci_setup_default_dpm_tables` fills five DPM tables (`dpm_levels[MAX_REGULAR_DPM_NUMBER=8]`)
from VBIOS dependency-table counts that are `u8` (up to 255) and only lower-bound
checked. A crafted VBIOS (`count>8`) overflows each 8-entry `dpm_levels[]` into
the adjacent `ci_single_dpm_table` and past `struct ci_dpm_table`.

## Status
Source-confirmed + harness. **Latent at runtime on this guest**: radeon is
`optional radeon drm`, NOT in `X86_64_GENERIC`, and the guest has no AMD GPU.

## Reproduce
```
./build.sh          # cc -O2 -Wall -o harness harness.c   (unprivileged maxx)
./run.sh            # prints the OOB write count (1235 for count=255) + fix check
```
Expected (harness): `DF-1150: CONFIRMED OOB heap write ... (VBIOS count=255 > MAX_REGULAR_DPM_NUMBER=8)`.

## Fix
`fix.diff` clamps every loop to `MAX_REGULAR_DPM_NUMBER` (and clamps `.count`).
Validated: applies + compiles clean (full `radeon.ko` build, `ci_dpm.o`, `-Werror`).
See `VERDICT.md` for the full analysis.