# DF-1413 — Unchecked VBIOS `conn_num` -> OOB write past `connectors[16]`

## Verdict: REPRODUCED (source-level + harness) — latent amdgpu-display bug, heap OOB write

## The bug

`sys/dev/drm/amd/display/dc/bios/bios_parser2.c`, function
`update_slot_layout_info`, lines 1732-1768:

```c
slot_layout_info->num_of_connectors = record->conn_num;   /* :1732 -- u8 VBIOS */
for (j = 0; j < slot_layout_info->num_of_connectors; ++j) {
    slot_layout_info->connectors[j].connector_type = ...; /* :1734 -- OOB */
    ...
}
```

`conn_num` is a `u8` (0..255) taken directly from the VBIOS record with **no
check** against `MAX_CONNECTOR_NUMBER_PER_SLOT` (16)
(`grph_object_defs.h:40,172`). With `conn_num > 16` the writes overflow
`connectors[16]` into the rest of `struct slot_layout_info` /
`board_layout_info` and the adjacent heap. The same pattern exists in
`bios_parser.c:2654` (`ucConnNum`). Crafted VBIOS on driver attach / display
init.

## Harness proof

```
VBIOS record->conn_num          = 255 (u8, no bounds check)
MAX_CONNECTOR_NUMBER_PER_SLOT   = 16
overflow slots                   = 239 past connectors[16]
connectors[16] = {type=1 len=10}  <-- FIRST OOB WRITE
RESULT: heap OOB write CONFIRMED at bios_parser2.c:1734
```

## Fix

`fix.diff` clamps `num_of_connectors` to `MAX_CONNECTOR_NUMBER_PER_SLOT`
after the assignment from `record->conn_num` and before the loop.

## Module build validation (Phase 8)

All 8 amdgpu fixes applied; `amdgpu.ko` built under `-Werror`:
`bios_parser2.o` (13384 bytes) produced, 0 errors, `amdgpu.ko` (3741488
bytes) linked. See `fix_module_proof.txt` / `fix_module_build.log`.

**Note:** the finding DB record cites `bios_parser2.c:1732` (`conn_num`);
the run-prompt table header says `bios_parser.c`. Both files contain the same
bug pattern (`bios_parser.c:2654` uses `ucConnNum`); the cited line 1732 is
in `bios_parser2.c`, which is what this verification targets.