DF-1299 bios_parser.c VBIOS flex-array OOB read harness
sizeof(ATOM_OBJECT)=8  sizeof(ATOM_OBJECT_TABLE)=12 (header+flex[1])
bios image: 20 bytes at page-tail 0x80047cfec (next page unmapped)
object table at bios offset 0; asObjects[0] @ 0x80047cff0, asObjects[1] @ 0x80047cff8
GET_IMAGE validates offset+12 < bios_size(20) -> PASS (bug)
walking ucNumberOfObjects=255 elements with NO per-element check...
  GET_IMAGE OK: validated only offset..offset+12 (sizeof=12)
  tbl->ucNumberOfObjects = 255 (VBIOS-controlled)
FAULT (signal 11): OOB read off the end of the bios buffer
  -> in-kernel equivalent: kmalloc'd bios buffer OOB heap read
RESULT: OOB read CONFIRMED at bios_parser.c:1994 (get_bios_object loop past GET_IMAGE-validated flex[1])
RUN_EXIT=0
RUN_EXIT=0