# DF-1307 — Unbounded VCE clk_idx heap OOB read in kv_parse_power_table

**Severity:** Medium · **CWE:** CWE-125 (Out-of-bounds Read)
**File:** `sys/dev/drm/radeon/kv_dpm.c:2705-2707`

## Build & run (radeon-DRM latent bug — no AMD GPU on guest, harness proof)

```
./build.sh   # cc -O2 -Wall -o harness harness.c
./run.sh     # ./harness
```

## Expected output (bug present)

```
VBIOS VCE clk_idx = 63  (NO check vs ucNumEntries=2)
access byte offset = 63 * 255 = 16065  (past the 2 valid entries)
FAULT (signal 11): OOB read at clockInfo[16065] off the bios buffer
RESULT: OOB read CONFIRMED at kv_dpm.c:2707
```

## Preconditions (kernel path)

`radeon` driver attach on Kabini/Kaveri/Mullins/Trinity APUs (VCE power-state
fill from powerplay tables). Attacker controls the VBIOS image (clk_idx is a
6-bit field in the VCE state record, r600_dpm.c:1128). See `VERDICT.md`. The
main clock loop at line 2683 checks bounds; the VCE loop (2705) does not —
that asymmetry is the bug.