/*
 * DF-1298 trigger-path documentation (NOT runnable on this guest).
 *
 * The overflow is in update_slot_layout_info() at
 *   sys/dev/drm/amd/display/dc/bios/bios_parser.c:2601
 * reached via get_bracket_layout_record() -> bios_get_board_layout_info()
 * during amdgpu display init, parsing the GPU card's VBIOS object/record table.
 *
 * Trigger (requires an AMD GPU whose VBIOS has ucConnNum > 16 in an
 * ATOM_BRACKET_LAYOUT_RECORD):
 *   - boot/attach an AMD GPU handled by amdgpu;
 *   - its VBIOS bracket-layout record with ucConnNum > 16 overflows
 *     slot_layout_info->connectors[16] -> heap corruption in board_layout_info.
 *
 * The QEMU audit guest has NO AMD GPU (vgapci0 = QEMU std-VGA 1234:1111) and
 * amdgpu.ko is not loaded, so the parser never executes here.
 *
 * Vulnerable signature:
 *   bios_parser.c:2654  num_of_connectors = record->ucConnNum;   // u8, unchecked
 *   bios_parser.c:2655  for (j=0; j<num_of_connectors; ++j) connectors[j] = ...
 *   -> ucConnNum > MAX_CONNECTOR_NUMBER_PER_SLOT(16) overflows connectors[].
 *
 * fix.diff clamps num_of_connectors to MAX_CONNECTOR_NUMBER_PER_SLOT.
 */
int main(void) { return 0; }