# DF-1320 — Unbounded MST stream_count → stack overflow (amdgpu)

**Status:** INCONCLUSIVE (real bug; needs AMD GPU + amdgpu + MST hardware, all absent)
**Impact:** stack buffer overflow via malicious MST hub (unauthenticated physical-layer)
**Driver:** amdgpu MST allocation — NOT in `X86_64_GENERIC`, not loaded

## Reproduce (hardware-equipped host only)
Requires an amdgpu host with a malicious MST hub/dock advertising >6
active payloads (LOCAL/REMOTE, non-zero slots).  Hotplug → payload
negotiation → `work_table[6]` stack overflow in
`update_mst_stream_alloc_table`.

On the audit guest: amdgpu absent, no AMD GPU, no MST hardware.  See
`VERDICT.md` for the source trace and `fix.diff` for the validated patch.

## Files
- `VERDICT.md`   — full mechanism trace with path:line citations
- `fix.diff`     — clamp stream_count to MAX_CONTROLLER_NUM (6) at table update
- `build.sh`/`run.sh` — document hardware repro + validate fix.diff applies
- `build.log`    — guest evidence: amdgpu absent
- `env.txt`, `manifest.json`