# DF-1349 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
EE_SPEED EEPROM byte used unbounded as index into eeprom_period[8]

## Source Location
sys/dev/disk/amd/amd.c:2342-192

## Verdict
Source-confirmed (complex fix): EE_SPEED EEPROM byte used unbounded as index into eeprom_period[8]. No diff in batch.

## Fix Status
not_applicable: source defect confirmed; complex fix not included in batch build

## Summary
amd_init at amd.c:2342: tinfo->user.period=eeprom_period[prom->EE_SPEED]. EE_SPEED u8 (0-255). eeprom_period has 8 entries. EE_SPEED>=8 -> OOB read up to 247 bytes past table into adjacent .data. Value programmed as sync period. Malicious/corrupted EEPROM. Fix: clamp EE_SPEED<8.