/*
 * DF-1254 trigger (latent / not live-reproducible on audit guest)
 *
 * vega20 OD8 capability/settings arrays are indexed by hardcoded
 * ATOM_VEGA20_* constants (0..9 / 0..13) but allocated to
 * min(VBIOS.ODFeatureCount, ATOM_VEGA20_ODFEATURE_COUNT) /
 * min(VBIOS.ODSettingCount, ATOM_VEGA20_ODSETTING_COUNT) entries.
 * A crafted VBIOS reporting fewer entries => the consumer
 * (vega20_od8_set_feature_capabilities @ vega20_hwmgr.c:906-975 and
 *  vega20_od8_initialize_default_settings @ vega20_hwmgr.c:1216-1221)
 * reads past the undersized kmalloc'd buffer => heap OOB read.
 *
 * This is NOT a userspace syscall; it fires at GPU powerplay init while
 * parsing the VBIOS AtomBIOS powerplay table. Reachability REQUIRES:
 *   1. an AMD Vega20-class GPU attached (amdgpu driver probes), AND
 *   2. a crafted VBIOS powerplay table with ODFeatureCount<10 or
 *      ODSettingCount<14 (e.g. a reflashed/malicious PCIe card VBIOS).
 *
 * The audit guest has NO AMD GPU (QEMU i440fx, display=none), so the
 * amdgpu/powerplay code path is never entered. This file documents the
 * trigger path only; see VERDICT.md for the source-level trace.
 */

/* consumer indices (vega20_hwmgr.c, vega20_pptable.h) are fixed:
 *   ATOM_VEGA20_ODFEATURE_GFXCLK_LIMITS  = 0
 *   ...
 *   ATOM_VEGA20_ODFEATURE_FAN_ZERO_RPM_CONTROL = 9   (ATOM_VEGA20_ODFEATURE_COUNT  = 10)
 *   ATOM_VEGA20_ODSETTING_*              = 0..13     (ATOM_VEGA20_ODSETTING_COUNT   = 14)
 * allocation (vega20_processpptables.c:824-846) is to the VBIOS-reported
 * count clamped to the enum => undersized when VBIOS reports < COUNT.
 */

int main(void) { return 0; }