# DF-1179 — vega10 DPM-table population: unbounded VBIOS ucNumEntries overflows dpm_levels[8]

## Finding
`vega10_setup_default_single_dpm_table()` (`vega10_hwmgr.c:1200-1217`) and the
inline `eclk`/`vclk`/`dclk` loops (`:1343-1383`) iterate
`dep_table->count` — a `u8` sourced from VBIOS (`ucNumEntries`, 0-255) — and
write `dpm_levels[dpm_table->count++]`. The destination is sized
`MAX_REGULAR_DPM_NUMBER = 8` (`vega10_hwmgr.h:122,136`). With >8 ascending
entries `dpm_table->count` exceeds 8 and the writes overflow into the
following `vega10_single_dpm_table` members of the `vega10_hwmgr` backend
(`gfx_table`, `mem_table`, …, then non-table fields). There is **no** bound
check (compare `vega12_hwmgr.c:989` which *does* clamp).

## Why harness
AMD GPU `powerplay` is **not** in `X86_64_GENERIC` (no `device drm`/`radeon`/
`amdgpu` in the kernel config; no AMD GPU on the QEMU guest). The VBIOS
dependency tables are read from the GPU's PCIe ROM. The bug is demonstrated at
the function level with a harness that replays the exact loop against crafted
VBIOS `count`.

## Build & run
```
./build.sh && ./run.sh
```

## Expected
Harness reports `count` climbing past 8 and identifies the overflowed adjacent
`vega10_single_dpm_table` field in the backend.