# DF-2027 PoC — VBIOS table parsers dereference attacker-controlled offsets

**Status:** `inconclusive` / reproduced=0 — **HW-GATED** (needs an AMD GPU; this guest has
none, `amdgpu.ko` not loaded, only generic VGA present).

**Verification method:** source trace of `sys/dev/drm/amd/amdgpu/atom.c:1384-1403`
(`amdgpu_atom_parse_data_header` returns the VBIOS-sourced `idx` as `data_start` with no
bounds check against `bios_size`) + `sys/dev/drm/amd/include/atom-bits.h:39` (`CU16` reads
`ctx->bios`) + the ~10 parsers in `sys/dev/drm/amd/amdgpu/amdgpu_atomfirmware.c`
(`:42,62,80,141,217,264,287,310,346`) that cast `ctx->bios + data_offset` to a struct and
read fields ⇒ OOB heap read with a crafted VBIOS. See `VERDICT.md`, `fix.diff`.

**Preconditions (realistic, but not arrangeable on this audit guest):** attacker controls
the VBIOS image via VFIO/PCI `romfile` passthrough, a compromised ACPI VFCT table, or a
reflashed ROM.

**Build/run:** no runtime PoC (no AMD GPU). `fix_build.log` proves `atom.c`,
`amdgpu_atomfirmware.c`, `amdgpu_atombios.c` recompiled with the fix under `-Werror` rc=0
and `amdgpu.ko` relinked.