# DF-1407 — Unbounded `i2c_bus[]` write in `amdgpu_atombios_i2c_init`

## Verdict: REPRODUCED (source-level + harness) — latent amdgpu-DRM bug, heap OOB write

## The bug

`sys/dev/drm/amd/amdgpu/amdgpu_atombios.c`, function
`amdgpu_atombios_i2c_init`, lines 137-152:

```c
num_indices = (size - sizeof(ATOM_COMMON_TABLE_HEADER)) /
              sizeof(ATOM_GPIO_I2C_ASSIGMENT);     /* :140 -- from VBIOS u16 size */
...
for (i = 0; i < num_indices; i++) {                 /* :144 */
    ...
    adev->i2c_bus[i] = amdgpu_i2c_create(...);      /* :151 -- OOB */
}
```

`size` is `u16` from the VBIOS `usStructureSize`. `num_indices` is a plain
`int` with **no bound check** against `AMDGPU_MAX_I2C_BUS` (16).
`adev->i2c_bus[]` is a fixed `[AMDGPU_MAX_I2C_BUS=16]` pointer array
(`amdgpu.h:841`). With `size = 0xFFFF`: `num_indices = (0xFFFF - 4) / 24 =
2729`, writing ~21 KB of pointers past `i2c_bus` into the rest of
`struct amdgpu_device` and the adjacent slab. Crafted/faulty VBIOS on driver
attach. Sibling of `bios_parser.c` DF-1299.

## Harness proof

```
VBIOS usStructureSize       = 65535 (0xffff)
num_indices (kernel math)   = 2730
AMDGPU_MAX_I2C_BUS          = 16  (amdgpu.h:841 i2c_bus[16])
overflow bytes              = 21712  (21 KB) of pointer writes
i2c_bus[16] = 0x1010  <-- FIRST OOB WRITE (past AMDGPU_MAX_I2C_BUS)
RESULT: heap OOB write CONFIRMED at amdgpu_atombios.c:151
```

## Fix

`fix.diff` clamps `num_indices` to `AMDGPU_MAX_I2C_BUS` before the loop:

```c
if (num_indices > AMDGPU_MAX_I2C_BUS)
    num_indices = AMDGPU_MAX_I2C_BUS;
```

## Module build validation (Phase 8)

All 8 amdgpu fixes were applied and `amdgpu.ko` built under `-Werror`:
`amdgpu_atombios.o` (19624 bytes) produced, 0 errors, `amdgpu.ko` (3741488
bytes) linked. See `fix_module_proof.txt` / `fix_module_build.log`.