/*
 * DF-1268 trigger (latent / not live-reproducible on audit guest)
 *
 * kv_dpm.c heap OOB WRITE past the fixed-size pi->*_level[] arrays.
 *
 *   kv_populate_uvd_table  @ :915   for(i=0;i<table->count;i++)  pi->uvd_level[i]
 *   kv_populate_vce_table  @ :986                              pi->vce_level[i]
 *   kv_populate_samu_table @ :1049                             pi->samu_level[i]
 *   kv_populate_acp_table  @ :1115                             pi->acp_level[i]
 *   kv_init_graphics_levels@ :2426/2446                        pi->graphics_level[i]
 *
 * table->count comes from VBIOS atom ucNumEntries (u8, 0..255); the
 * destination arrays are fixed-size SMU7_MAX_LEVELS_* (==8). The guard
 *   if (pi->high_voltage_t && ...) break;
 * is DEAD: high_voltage_t is kzalloc-zeroed and never assigned anywhere
 * in kv_dpm.c (grep 'high_voltage_t =' => no hits), so it is always 0
 * and the break never fires. A crafted VBIOS with count>8 therefore
 * writes past the arrays embedded in struct kv_power_info => heap OOB
 * write at powerplay/dpm init.
 *
 * Reachability REQUIRES a Kabini/Kaveri/Tonga AMD APU/GPU (amdgpu kv_dpm
 * path). No such HW on the audit guest => not live-reproducible. See
 * VERDICT.md for the source-level trace.
 */

int main(void) { return 0; }