# DF-1316 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** certain

## Finding
Bogus-length firmware kept loaded: missing goto out after me/rlc/mc/smc size checks causes OOB heap reads

## Source Location
sys/dev/drm/radeon/ni.c:769-817

## Verdict
Source-confirmed: Bogus-length firmware kept loaded: missing goto out after me/rlc/mc/sm. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
ni_init_microcode at ni.c:769-817: ME/RLC/MC/SMC size checks set err=-EINVAL but do NOT goto out (unlike PFP at :757 which does). Next request_firmware overwrites err. Function returns 0 with wrong-sized firmware attached. Consumers (cayman_cp_load_microcode :1543-1552 CAYMAN_PM4_UCODE_SIZE=8704 dwords, ni_mc_load_microcode :668 BTC_MC_UCODE_SIZE=6024 dwords, evergreen.c:4406 RLC size) iterate compile-time constant count over undersized buffer -> OOB heap read up to ~8KB into MMIO. Requires corr