# DF-1306 — Unbounded nonClockInfoIndex heap OOB read in kv_parse_power_table

**Severity:** Medium · **CWE:** CWE-125 (Out-of-bounds Read)
**File:** `sys/dev/drm/radeon/kv_dpm.c:2668-2670`

## Build & run (radeon-DRM latent bug — no AMD GPU on guest, harness proof)

```
./build.sh   # cc -O2 -Wall -o harness harness.c
./run.sh     # ./harness
```

## Expected output (bug present)

```
VBIOS nonClockInfoIndex = 255  (NO check vs ucNumEntries=1)
FAULT (signal 11): OOB read at nonClockInfo[255] off the bios buffer
RESULT: OOB read CONFIRMED at kv_dpm.c:2670
```

## Preconditions (kernel path)

`radeon` driver attach on Kabini/Kaveri/Mullins/Trinity APUs (powerplay table
parse). Attacker controls the VBIOS image. See `VERDICT.md`. The clock path at
line 2683 checks bounds; the non-clock path (2668) does not — that asymmetry is
the bug.