# DF-1254 PoC — vega20 OD8 OOB read (LATENT)

**Status:** source-confirmed real; NOT reproducible on audit guest (no AMD GPU).
**Impact:** heap OOB read (info leak) via crafted VBIOS powerplay table.
**Driver:** `sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c` + `vega20_processpptables.c` (amdgpu, not in GENERIC, no HW).

## Reproduce
```
./build.sh && ./run.sh   # trigger is a stub; bug path is VBIOS-parse/GPU-init
```
The bug fires only at Vega20 GPU powerplay init with a crafted VBIOS. See
`VERDICT.md` for the full source-level trace and `fix.diff` for the fix.