# DF-2083: Heap OOB read in amdgpu_dm_set_degamma_lut via unvalidated blob size

## Verdict: NOT REPRODUCED (HW-gated) — source-confirmed real bug

## Reachability
**NOT reachable on this QEMU guest.** `amdgpu_dm_set_degamma_lut()` is in
`sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c`, part of the `amdgpu.ko` module.
Requires an AMD GPU to attach. PCI survey shows only QEMU stdvga (`0x1234`), no AMD GPU.
`kldload amdgpu` would fail to find matching hardware.

## Mechanism (source-confirmed)
`amdgpu_dm_set_degamma_lut()` at `amdgpu_dm_color.c:243-291`:
1. Line 259: `lut = (struct drm_color_lut *)blob->data`
2. Line 260: `__is_lut_linear(lut, MAX_COLOR_LUT_ENTRIES)` — iterates over
   `MAX_COLOR_LUT_ENTRIES=4096` entries **before validating blob size**
3. Blob size not computed until line 270: `lut_size = blob->length / sizeof(struct drm_color_lut)`

If `blob->length < 4096 * sizeof(struct drm_color_lut)` (i.e. fewer than 4096 LUT entries),
`__is_lut_linear()` reads past the blob data → **heap OOB read**.

`struct drm_color_lut` is 12 bytes (3 × uint16_t + 2 bytes pad). 4096 entries = 49152 bytes.
A blob of 1 entry (12 bytes) would cause `__is_lut_linear` to read 49140 bytes past the blob.

## Primitive
- Class: heap OOB read (info leak)
- Read size: up to `4096 * 12 - blob->length` bytes past allocation
- Could leak adjacent slab data (kernel pointers, sensitive data)

## Fix
`fix.diff`: Compute `lut_size` from `blob->length` before calling `__is_lut_linear()`, and
validate it's within `[1, MAX_COLOR_LUT_ENTRIES]`. Use `lut_size` instead of `MAX_COLOR_LUT_ENTRIES`
as the iteration count.