/*
 * DF-1314 trigger-path documentation (NOT runnable on this guest).
 *
 * The off-by-one is in btc_copy_vbios_mc_reg_table() at
 *   sys/dev/drm/radeon/btc_dpm.c:1987
 * reached during radeon BTC (Barts/Turks/Caicos) DPM init
 * (btc_initialize_mc_reg_table -> btc_copy_vbios_mc_reg_table +
 * btc_set_mc_special_registers), consuming the MC register table from VBIOS.
 *
 * Trigger (requires an affected evergreen/NI radeon GPU whose VBIOS MC-reg
 * table has last == 16):
 *   - load radeon.ko on such hardware; the `> SIZE` guard admits last==16,
 *     then btc_set_mc_special_registers writes mc_reg_address[16]/mc_data[16]
 *     BEFORE the `j >= SIZE` post-write guard -> OOB heap write past
 *     evergreen_mc_reg_table into vddc_voltage_table.
 *
 * The QEMU audit guest has NO AMD GPU; radeon.ko is not loaded, so the path
 * never runs here.
 *
 * Vulnerable signature:
 *   btc_dpm.c:1992  if (table->last > SMC_EVERGREEN_MC_REGISTER_ARRAY_SIZE)  // should be >=
 *   btc_dpm.c:1920  j = table->last;          // == 16 admitted
 *   btc_dpm.c:1924  table->mc_reg_address[j].s1 = ...;   // index 16 OOB
 *   btc_dpm.c:1933  if (j >= SIZE) return -EINVAL;       // post-write, too late
 *   sibling: ni_dpm.c:2850 has the identical `>` bug.
 *
 * fix.diff changes `>` to `>=` so last==16 is rejected.
 */
int main(void) { return 0; }