# DF-1163 — PoC evidence pack

**Heap OOB write+read in `gfx_v7_0_init_cp_pg_table` (amdgpu `sys/dev/drm/amd/amdgpu/gfx_v7_0.c:3787-3852`).**

For each of up to 5 ME firmware blobs, `jt_offset`/`jt_size` are read straight
from the firmware header with no validation and copied into the 16896-dword
`cp_table` BO (`dst_ptr[bo_offset+i] = fw_data[table_offset+i]`), with
`bo_offset += jt_size` accumulating across all MEs. A crafted firmware header
overflows the cp_table BO (OOB write) and/or reads past the firmware blob
(OOB read / heap info leak). gfx_v7 twin of DF-1134.

## Status
Source-confirmed + harness. **Latent at runtime on this guest**: amdgpu is NOT
in `X86_64_GENERIC`, and the guest has no AMD GPU.

## Reproduce
```
./build.sh          # cc -O2 -Wall -o harness harness.c   (unprivileged maxx)
./run.sh            # prints OOB write/read iterations + fix check
```
Expected (harness): `4300` OOB-write iters, `18072` OOB-read iters; fix → 0.

## Fix
`fix.diff` rejects (per ME) `jt_size`/`jt_offset` that read past the firmware
blob or write past the cp_table. Validated: applies + compiles clean (full
`amdgpu.ko` build, `gfx_v7_0.o`, `-Werror`). See `VERDICT.md`.