# DF-1268 PoC — kv_dpm unbounded VBIOS counts: heap OOB WRITE (LATENT)

**Status:** source-confirmed real (certain); NOT reproducible on audit guest (no AMD GPU).
**Impact:** heap OOB write past `kv_power_info.*_level[]` via crafted VBIOS count>8.
**Driver:** `sys/dev/drm/amd/amdgpu/kv_dpm.c` (amdgpu kv path, not in GENERIC, no HW).
The `high_voltage_t` guard is dead (never assigned).

## Reproduce
```
./build.sh && ./run.sh   # stub; bug path is VBIOS-parse at GPU dpm init
```
See `VERDICT.md` + `fix.diff`.