# DF-1250 — reproduction

Userspace harness replicating `radeon_combios_check_hardcoded_edid()`'s
`size = 128*(raw[0x7e]+1)` computation and the resulting BIOS over-read.

The live kernel trigger requires an AMD/ATI radeon GPU with a malicious
Video BIOS (absent from the QEMU guest); the harness proves the over-read
math against a 512-byte BIOS slab.

```sh
./build.sh && ./run.sh
```

Expected: `PRIMITIVE CONFIRMED: memcpy(edid, raw, 32768) reads 32320 bytes past a 512-byte BIOS slab.`

Fix: `fix.diff` adds a `bios_length` field + bounds the EDID read. Builds
cleanly into `radeon.ko` (`-Werror`). See `VERDICT.md`.