DF-1416 smu8 levels[] OOB write harness
VBIOS pstate->ucNumDPMLevels     = 255 (u8, no check vs SMU8_MAX)
SMU8_MAX_HARDWARE_POWERLEVELS    = 8 (smu8_hwmgr.h:33)
overflow iterations              = 247 past levels[8]
overflow bytes                   = 1976  (struct smu8_power_level each)

  levels[7]  = {engineClock=1000007 vddc=7}  (in-bounds, last legal)
  levels[8]  = {engineClock=1000008 vddc=8}  <-- FIRST OOB WRITE
  levels[9]  = {engineClock=1000009 vddc=9}  <-- OOB
  ps->level  = 16  (overwrites count field via :1358)
  canary     = 0x0badf00ddeadbeef  (expected 0x0badf00ddeadbeef)

RESULT: heap OOB write CONFIRMED at smu8_hwmgr.c:1355 via ucNumDPMLevels
levels[8] is the last field of struct smu8_power_state; writes corrupt
adjacent pp_power_state list pointers -> UAF / list corruption.
Caller: processpptables.c:928 (no bound check on ucNumDPMLevels).
RUN_EXIT=0