# DF-2005 PoC — Heap OOB read via truncated VBIOS PowerPlay table

## Trigger (firmware-driven)

Craft a minimal ATOM VBIOS image (~2 KB) that:

(a) passes `check_atom_bios` signature validation
    (`ATOM_BIOS_MAGIC = 0xAA55` at offset 0, `ATOM` at offset 0x30,
    ATOM ROM table magic);
(b) contains a powerplay data table entry in the master data table with
    `data_start` pointing near the end of the buffer and `size`/`structuresize`
    set to small nonzero values;
(c) sets `sHeader.format_revision = 9` and `sHeader.structuresize = 1`
    (passes both checks in `check_powerplay_tables`).

## Load vectors

1. QEMU with `-device vfio-pci,romfile=malicious.rom`
2. Custom PCI device option ROM (physical attacker card)
3. Malicious hypervisor supplying crafted VBIOS to a guest VM with AMD GPU
   passthrough

## Expected output

On guest boot with AMDGPU driver, `vega12_pp_tables_initialize()` calls
`init_powerplay_table_information()` which `memcpy`s `sizeof(PPTable_t)` bytes
(~1 KB) from the truncated table, reading past the BIOS heap buffer.

**Success:**

- **amdgpu_read_bios_from_rom path (attacker-controlled alloc size):** kernel
  panic (page fault on unmapped memory).
- **igp_read_bios_from_vram path (fixed 256 KB buffer):** info leak into
  `pptable_information->smc_pptable` — read back via
  `/sys/class/drm/card0/device/pp_dpm_sclk` or `pp_od_clk_voltage`.

## Success criterion

`dmesg` shows "Fatal trap 12: page fault while in kernel mode" rooted in
`init_powerplay_table_information` for the panic path, or corrupted/non-zero
powerplay values in the sysfs reads for the info-leak path.