DF-1413 / run.log
DF-1413 bios_parser2 update_slot_layout_info connectors[] OOB harness
VBIOS record->conn_num = 255 (u8, no bounds check)
MAX_CONNECTOR_NUMBER_PER_SLOT = 16 (grph_object_defs.h:40)
overflow slots = 239 past connectors[16]
overflow bytes = 3824 of connector_layout_info writes
connectors[15] = {type=1 len=10} (in-bounds, last legal slot)
connectors[16] = {type=1 len=10} <-- FIRST OOB WRITE
connectors[17] = {type=1 len=10} <-- OOB
canary = 0xabcdef0123456789 (expected 0xabcdef0123456789)
canary (simulating adjacent heap) intact
RESULT: heap OOB write CONFIRMED at bios_parser2.c:1734
With crafted conn_num (VBIOS u8), writes overflow connectors[16] into
board_layout_info / adjacent slab. Local DoS / memory corruption on
amdgpu driver attach with crafted VBIOS.
RUN_EXIT=0