# DF-1299 — VBIOS flex-array OOB heap reads in bios_parser.c

**Severity:** Medium · **CWE:** CWE-125 (Out-of-bounds Read)
**File:** `sys/dev/drm/amd/display/dc/bios/bios_parser.c` (get_bios_object:1994 + 3 sibling sites)

## Build & run (AMD-DC latent bug — no AMD GPU on guest, harness proof)

```
./build.sh   # cc -O2 -Wall -o harness harness.c
./run.sh     # ./harness
```

## Expected output (bug present)

```
sizeof(ATOM_OBJECT)=8  sizeof(ATOM_OBJECT_TABLE)=12 (header+flex[1])
GET_IMAGE validates offset+12 < bios_size(20) -> PASS (bug)
walking ucNumberOfObjects=255 elements with NO per-element check...
FAULT (signal 11): OOB read off the end of the bios buffer
RESULT: OOB read CONFIRMED at bios_parser.c:1994
```

After `fix.diff`, the re-validation via `bios_get_image(offset, 4 + N*8)`
returns NULL for a crafted VBIOS whose extent doesn't cover all N objects, so
the function returns NULL and the loop is never entered.

## Preconditions (kernel path)

`amdgpu` driver attach (VBIOS connector/GPIO/SS enumeration). Attacker controls
the VBIOS image (malicious ROM, VFIO passthrough, supply-chain). See `VERDICT.md`.