DF-1183 / run.log
== buggy == vega10_get_soc_index_for_max_uclk hardcoded entries[3] but count=2 => OOB read (CWE-125) Returned index (garbage, from past-allocation bytes): 1 == fixed == Fixed version returns -1 (validated count < 4) === DF-1183 logic-level result === Hardcoded entries[3] without count check on a table allocated for ucNumEntries slots. Malicious VBIOS with ucNumEntries<4 reads kernel heap. Path runs only when amdgpu powerplay is attached to a real Vega10 GPU - no AMD HW on this guest. RUN_EXIT=0