# DF-1409 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
OOB read of fixed-size ucMuxState[2] via BIOS-controlled enum_id in router-record parsing

## Source Location
sys/dev/drm/amd/amdgpu/amdgpu_atombios.c:431-475

## Verdict
Source-confirmed: OOB read of fixed-size ucMuxState[2] via BIOS-controlled enum_id in ro. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
amdgpu_atombios_get_connector_info_from_object_table at amdgpu_atombios.c:438-475: enum_id from loop over BIOS u8 num_dst_objs (0-255). ucMuxState[enum_id] where array is u8[2]. No match -> enum_id=num_dst_objs. enum_id>=2 -> OOB read past ucMuxState into adjacent BIOS. Leaked to userspace via DRM router/connector properties. Crafted VBIOS. Fix: clamp enum_id<ARRAY_SIZE(ucMuxState).