# DF-1251 — reproduction

Userspace harness replicating the unbounded `combios_parse_mmio_table`
`while (RBIOS16(offset))` walk and the resulting OOB reads + heap-sourced
`WREG32` writes.

The live kernel trigger requires an AMD/ATI radeon GPU with a malicious
Video BIOS (absent from the QEMU guest); the harness proves the unbounded-
loop OOB + MMIO-write primitive.

```sh
./build.sh && ./run.sh
```

Expected: `PRIMITIVE CONFIRMED: unbounded loop read 2 words past rdev->bios into heap, and wrote 75 (addr,val) pairs to GPU MMIO (WREG32). Bug is REAL.`

Fix: `fix.diff` adds a `bios_length` field + bounds the three table-walk
loops. Builds cleanly into `radeon.ko` (`-Werror`). See `VERDICT.md`.