DF-1470 processpptables VBIOS USHORT offset OOB deref harness
table real size         = 16 bytes
redzone size            = 32 bytes (marker-filled)
marker ext_header at    = offset 16 (just past the table)
marker usSize           = 0xbeef
marker usVCETableOffset = 0xcafe

In-bounds  usExtendendedHeaderOffset=0 -> vce_offset=0 (OK)
OOB        usExtendendedHeaderOffset=16 (past table) -> vce_offset=0xcafe
                                  (matches marker usVCETableOffset=0xcafe)
Worst case usExtendendedHeaderOffset=0xFFFF -> deref at base+65535,
           ~64KB past the powerplay table -> cascading arbitrary read.

RESULT: heap OOB read CONFIRMED (processpptables.c:60-65 pattern)
USHORT offsets (usExtendendedHeaderOffset/usStateArrayOffset/
usClockInfoArrayOffset/usVCETableOffset/...) added to powerplay_table
base and deref'd with NO check vs soft_pp_table_size. A single
malicious offset cascades into arbitrary-read-then-corrupt chains.
RUN_EXIT=0