DF-1165 PoC verification — source-level trace of drm_parse_tiled_block OOB
read past EDID extension.

drm is not in X86_64_GENERIC; it exists only as a kld module. Loading drm on
the QEMU guest succeeds but attaches to no device (no GPU), so no connector →
no EDID read → drm_parse_tiled_block is never invoked. Verification is by
source-level trace + build-validation of the fix.

## Bug location
- `sys/dev/drm/drm_edid.c:5103` — drm_parse_tiled_block entry
- `sys/dev/drm/drm_edid.c:5112-5135` — reads up to topology_id[7] (offset 23)
- `sys/dev/drm/drm_edid.c:5174-5177` — caller loop only checks num_bytes vs length, not vs struct size
- `sys/dev/drm/include/drm/drm_displayid.h:67-74` — displayid_tiled_block layout (24B)

## Mechanism
Caller guarantees `idx + 3 + num_bytes <= length` but not `num_bytes >= 21`
(the tiled-block body size). A DATA_BLOCK_TILED_DISPLAY block at idx near the
end of a 128-byte EDID extension with small num_bytes (e.g. 4) causes
drm_parse_tiled_block to read offsets up to 23 from the block start, walking
past the extension into adjacent kernel heap. Leaked bytes flow to
connector->tile_h/v_size and tile->topology_id (IDR-persisted).

## Reproduce
1. Apply `fix.diff` to /usr/src.
2. `cd /usr/src/sys/dev/drm/drm && make KMOD=drm`  →  drm.ko builds clean.
3. Runtime test requires DRM-attached GPU + malicious monitor/adapter/VM
   display with crafted DisplayID (not present on this guest).

See `VERDICT.md` for the full analysis.