# DF-1252 — Unvalidated 16-bit BIOS offsets dereferenced in LVDS mode-table and GPIO voltage-table parsing

## Verdict
**SOURCE-CONFIRMED (real bug), INCONCLUSIVE at runtime** — the `radeon.ko` module is not loaded (no AMD GPU with legacy COMBIOS in the QEMU guest) and is not in the GENERIC kernel, so the unvalidated-offset paths are dormant. Fix authored and compile-validated.

## Mechanism (source trace)
`RBIOS16(i)` / `RBIOS8(i)` are raw byte-indexing macros into the cached BIOS blob with **no bounds check** (`sys/dev/drm/radeon/radeon.h:2686-2688`):
```
#define RBIOS8(i)  (rdev->bios[i])
#define RBIOS16(i) (RBIOS8(i) | (RBIOS8((i)+1) << 8))
#define RBIOS32(i) ((RBIOS16(i)) | (RBIOS16((i)+2) << 16))
```
`rdev->bios` is a `kmalloc(size, …)` blob (`radeon_bios.c:68,98,269,717`) whose `size` is the ROM image length (variable; never stored on the struct). Two parser paths read a 16-bit offset from the BIOS and then dereference it without validating it lies within the blob:

**Path 1 — LVDS native-mode table** (`radeon_combios.c:1246-1272`):
```
for (i = 0; i < 32; i++) {
    tmp = RBIOS16(lcd_info + 64 + i * 2);   /* tmp = attacker/BIOS-controlled 16-bit offset */
    if (tmp == 0) break;
    /* NO bounds check that tmp < bios_size */
    if ((RBIOS16(tmp) == hdisplay) &&        /* derefs bios[tmp], bios[tmp+1] */
        (RBIOS16(tmp + 2) == vdisplay)) {     /* derefs bios[tmp+2], bios[tmp+3] */
        ... RBIOS16(tmp + 17), RBIOS16(tmp+19), RBIOS16(tmp+21), RBIOS8(tmp+23),
            RBIOS16(tmp+24), RBIOS16(tmp+26), RBIOS16(tmp+28), RBIOS16(tmp+9) ...
```
With `tmp` up to 0xFFFF and the BIOS blob often < 64KB, every `RBIOS*(tmp+N)` reads up to ~64KB past the allocation → kernel heap OOB read. The leaked u32s land in `lvds->native_mode` (htotal/vtotal/clock/etc.) which are exposed to userspace via the DRM mode-info ioctl.

**Path 2 — GPIO voltage table** (`radeon_combios.c:2754-2760`):
```
u16 voltage_table_offset = RBIOS16(offset + 0x5 + 0xc);   /* unchecked 16-bit offset */
if (entries && voltage_table_offset) {
    ... RBIOS16(voltage_table_offset) * 4;                 /* derefs bios[vto], bios[vto+1] */
        RBIOS8(voltage_table_offset + 0x2);                /* derefs bios[vto+2] */
```
Same OOB-read pattern.

## Why not reproduced at runtime
- `radeon.ko` is **not loaded** on the guest and is **not in X86_64_GENERIC**.
- Requires an AMD Radeon GPU with a legacy COMBIOS (pre-AtomBIOS ATI chips) attached; QEMU guest has no AMD GPU.
- The BIOS image is read from the card's ROM at probe time; a malicious PCI card (VFIO passthrough) could supply a crafted ROM. Not unprivileged-user-triggered.

## Fix (fix.diff, compile-validated)
1. Add `size_t bios_size;` to `struct radeon_device` (`radeon.h`) and a `radeon_bios_in(rdev, off, len)` bounds-check helper.
2. Set `rdev->bios_size` at every allocation site in `radeon_bios.c` (and clear it on the NULL error paths).
3. Guard both cited paths in `radeon_combios.c`: skip the entry if `!radeon_bios_in(rdev, tmp, 30)` (LVDS) / `!radeon_bios_in(rdev, voltage_table_offset, 3)` (voltage table).

The patched `radeon.h`, `radeon_bios.c`, and `radeon_combios.c` all compile cleanly with gcc 8.3, `-Werror`, no warnings.

## Realistic impact ceiling
Kernel heap OOB read (up to ~64KB) of attacker/BIOS-influenced data, with partial leak to userspace via DRM mode ioctls, triggered by a malicious PCI card's crafted ROM at GPU probe. On this guest: **not reachable** (no AMD GPU). Driver/hardware-trust hardening fix.