DF-1407 amdgpu_atombios_i2c_init unbounded i2c_bus[] write harness
VBIOS usStructureSize       = 65535 (0xffff)
sizeof(HEADER)              = 4
sizeof(ASSIGNMENT)          = 24
num_indices (kernel math)   = 2730
AMDGPU_MAX_I2C_BUS          = 16  (amdgpu.h:841 i2c_bus[16])
overflow pointers           = 2714  past i2c_bus[16]
overflow bytes              = 21712  (21 KB) of pointer writes

  i2c_bus[15] = 0x100f  (in-bounds, last legal slot)
  i2c_bus[16] = 0x1010  <-- FIRST OOB WRITE (past AMDGPU_MAX_I2C_BUS)
  i2c_bus[17] = 0x1011  <-- OOB
  canary      = 0xdeadbeefcafebabe  (expected 0xdeadbeefcafebabe)

canary (simulating rest of struct amdgpu_device) intact

RESULT: heap OOB write CONFIRMED at amdgpu_atombios.c:151
Crafted VBIOS with usStructureSize=0xFFFF writes 2730 pointers past
i2c_bus[16] into struct amdgpu_device + adjacent slab.
RUN_EXIT=0