DF-1469 processpptables VBIOS entry-count OOB read harness
real ucNumEntries        = 2 (what the image actually holds)
sizeof(dep_record)       = 5
marker clk=0xabcdef volt=0x1234 placed in redzone slots 2..7

In-bounds  ucNumEntries=2 -> clk[0]=0x11000 volt[0]=0x800 (OK)
OOB        ucNumEntries=8 (inflated) -> clk[2]=0xabcdef volt[2]=0x1234
                                  (expected marker clk=0xabcdef volt=0x1234)
Worst case ucNumEntries=255 -> loop reads 255 entries, 1275 bytes past entries[0]

RESULT: heap OOB read CONFIRMED (processpptables.c:393 count loop)
Every table parser trusts the VBIOS UCHAR count to size BOTH the
destination kmalloc AND the source loop; soft_pp_table_size (:844)
is available but never used as a bound. Inflated count -> OOB read
of adjacent kernel memory, parsed as clocks/voltages.
RUN_EXIT=0