=== patch --dry-run --forward output (proves fix.diff applies cleanly) ===
cmd: cd /usr/src && patch -p1 --dry-run --forward < DF-1498.diff

APPLIES_OK (verified 2026-07-21 on with-src #0 baseline)

--- fix.diff hunk summary ---
@@ -1495,6 +1495,18 @@
+		/* Validate that all offsets fall inside the table to
+		 * prevent OOB reads of attacker-controlled BIOS data. */
+		if (profile->usLeakageBinArrayOffset +
+			(profile->ucLeakageBinNum * (uint32_t)sizeof(u16)) >
+		    le16_to_cpu(profile->asHeader.usStructureSize) ||
+		    profile->usElbVDDC_IdArrayOffset +
+			(profile->ucElbVDDC_Num * (uint32_t)sizeof(u16)) >
+		    le16_to_cpu(profile->asHeader.usStructureSize) ||
+		    profile->usElbVDDC_LevelArrayOffset +
+			(profile->ucElbVDDC_Num * profile->ucLeakageBinNum * (uint32_t)sizeof(u16)) >
+		    le16_to_cpu(profile->asHeader.usStructureSize))
+			return -EINVAL;