BUILD_EXIT=0
=== DF-1783 radeon_atrm_call heap overflow harness ===
rdev->bios = malloc(262144)  [radeon_bios.c:269]

i= 0: offset=0, ACPI len=4096, space left=262144
i= 1: offset=4096, ACPI len=4096, space left=258048
i= 2: offset=8192, ACPI len=4096, space left=253952
i= 3: offset=12288, ACPI len=4096, space left=249856
i= 4: offset=16384, ACPI len=4096, space left=245760
i= 5: offset=20480, ACPI len=4096, space left=241664
i= 6: offset=24576, ACPI len=4096, space left=237568
i= 7: offset=28672, ACPI len=4096, space left=233472
i= 8: offset=32768, ACPI len=4096, space left=229376
i= 9: offset=36864, ACPI len=4096, space left=225280
i=10: offset=40960, ACPI len=4096, space left=221184
i=11: offset=45056, ACPI len=4096, space left=217088
i=12: offset=49152, ACPI len=4096, space left=212992
i=13: offset=53248, ACPI len=4096, space left=208896
i=14: offset=57344, ACPI len=4096, space left=204800
i=15: offset=61440, ACPI len=4096, space left=200704
i=16: offset=65536, ACPI len=4096, space left=196608
i=17: offset=69632, ACPI len=4096, space left=192512
i=18: offset=73728, ACPI len=4096, space left=188416
i=19: offset=77824, ACPI len=4096, space left=184320
i=20: offset=81920, ACPI len=4096, space left=180224
i=21: offset=86016, ACPI len=4096, space left=176128
i=22: offset=90112, ACPI len=4096, space left=172032
i=23: offset=94208, ACPI len=4096, space left=167936
i=24: offset=98304, ACPI len=4096, space left=163840
i=25: offset=102400, ACPI len=4096, space left=159744
i=26: offset=106496, ACPI len=4096, space left=155648
i=27: offset=110592, ACPI len=4096, space left=151552
i=28: offset=114688, ACPI len=4096, space left=147456
i=29: offset=118784, ACPI len=4096, space left=143360
i=30: offset=122880, ACPI len=4096, space left=139264
i=31: offset=126976, ACPI len=4096, space left=135168
i=32: offset=131072, ACPI len=4096, space left=131072
i=33: offset=135168, ACPI len=4096, space left=126976
i=34: offset=139264, ACPI len=4096, space left=122880
i=35: offset=143360, ACPI len=4096, space left=118784
i=36: offset=147456, ACPI len=4096, space left=114688
i=37: offset=151552, ACPI len=4096, space left=110592
i=38: offset=155648, ACPI len=4096, space left=106496
i=39: offset=159744, ACPI len=4096, space left=102400
i=40: offset=163840, ACPI len=4096, space left=98304
i=41: offset=167936, ACPI len=4096, space left=94208
i=42: offset=172032, ACPI len=4096, space left=90112
i=43: offset=176128, ACPI len=4096, space left=86016
i=44: offset=180224, ACPI len=4096, space left=81920
i=45: offset=184320, ACPI len=4096, space left=77824
i=46: offset=188416, ACPI len=4096, space left=73728
i=47: offset=192512, ACPI len=4096, space left=69632
i=48: offset=196608, ACPI len=4096, space left=65536
i=49: offset=200704, ACPI len=4096, space left=61440
i=50: offset=204800, ACPI len=4096, space left=57344
i=51: offset=208896, ACPI len=4096, space left=53248
i=52: offset=212992, ACPI len=4096, space left=49152
i=53: offset=217088, ACPI len=4096, space left=45056
i=54: offset=221184, ACPI len=4096, space left=40960
i=55: offset=225280, ACPI len=4096, space left=36864
i=56: offset=229376, ACPI len=4096, space left=32768
i=57: offset=233472, ACPI len=4096, space left=28672
i=58: offset=237568, ACPI len=4096, space left=24576
i=59: offset=241664, ACPI len=4096, space left=20480
i=60: offset=245760, ACPI len=4096, space left=16384
i=61: offset=249856, ACPI len=4096, space left=12288
i=62: offset=253952, ACPI len=4096, space left=8192
i=63: offset=258048, ACPI len=8192, space left=4096  <-- OVERFLOW
        memcpy writes 4096 bytes past rdev->bios end!

VERDICT: BUG CONFIRMED. radeon_atrm_call memcpy uses the
        ACPI-returned Length without clamping to the caller's
        `len` argument or checking obj->Type==BUFFER. A malicious
        _ATRM method overflows rdev->bios (256 KB) at i=63.
RUN_EXIT=0