[OOB] vddc_lookup_table->entries[200] (max 8, count 8) => would read past 84-byte allocation (CWE-125)
[OOB] vddci_lookup_table->entries[100] (max 4, count 4) => reads up to 1000 bytes past allocation
[OOB] vddci_lookup_table->entries[255] (max 4, count 4) => reads up to 2550 bytes past allocation

=== DF-1181 logic-level result ===
All three index classes (vddInd / vddciInd / mvddInd) are read
unchecked as uint8_t from VBIOS records and used to index into
fixed-size lookup tables. Malicious VBIOS reads kernel heap.
Path runs only when amdgpu/powerplay attaches to a real Vega10
GPU — no AMD hardware on this guest, so unreachable here.
RUN_EXIT=0