[OOB] socclk->entries[200] (ucNumEntries=2) reads past 20-byte allocation (CWE-125)
[OOB] gfxclk->entries[100] (ucNumEntries=3) reads past 28-byte allocation (CWE-125)
[OOB] mclk->entries[5] (ucNumEntries=1) reads past 12-byte allocation (CWE-125)
[OOB] socclk->entries[255] (ucNumEntries=2) reads past 20-byte allocation (CWE-125)
[OOB] gfxclk->entries[50] (ucNumEntries=3) reads past 28-byte allocation (CWE-125)
[OOB] mclk->entries[99] (ucNumEntries=1) reads past 12-byte allocation (CWE-125)

=== DF-1182 logic-level result ===
Six u8 clock indices are used to index dep tables with NO
bounds check against ucNumEntries.  Malicious VBIOS reads
kernel heap past the small dep-table allocation.
Path runs only when amdgpu powerplay attaches to a real Vega10
GPU - no AMD hardware on this guest, so unreachable here.
RUN_EXIT=0