DF-1437 sumo_construct_vid_mapping_table entries[] OOB harness
VBIOS usVoltageIndex             = 7 (u16, no bound check)
SUMO_MAX_NUMBER_VOLTAGES         = 4 (sumo_dpm.h:52)
(Worst case usVoltageIndex=0xFFFF -> write at offset 131070 bytes)

  entries[3] = {vid_7bit=0x00 vid_2bit=0x00}  (in-bounds, last legal)
  entries[4] = {vid_7bit=0x00 vid_2bit=0x00}  <-- FIRST OOB WRITE
  entries[7] = {vid_7bit=0x15 vid_2bit=0x07}  <-- OOB (target)
  canary     = 0xcafebabe12345678  (expected 0xcafebabe12345678)

RESULT: heap OOB write CONFIRMED at sumo_dpm.c:1624
Crafted VBIOS sAvail_SCLK.usVoltageIndex (u16) overflows entries[4];
with usVoltageIndex=0xFFFF the write lands ~256KB-512KB past the struct.
Also reachable via trinity_dpm.c and kv_dpm.c (3 APU DPM drivers).
RUN_EXIT=0