== DF-3585 harness: si_get_svi2_voltage_table heap OOB write ==
kernel: sys/dev/drm/amd/amdgpu/si_dpm.c:4410-4414, guest: no AMD GPU, logic replica

[A] dep->count = 255 (BIOS u8 from VddcDependencyOnMCLK.ucNumEntries)
[A] entries[] capacity = 32 (MAX_VOLTAGE_ENTRIES, amdgpu_atombios.h:119)
[A] vddc_voltage_table.count now = 255 (already > capacity)
[A] first OOB slot i=32 lands at vddci_voltage_table.count -> now 4128 (BIOS-chosen u16 0x1020)
[A] vddci_voltage_table.mask_low -> now 0x0 (zeroed by smio_low=0 store)
[A] bytes of the heap object rewritten past entries[32] = 446 (of 2356 until object end)
[A] RESULT: OOB WRITE CONFIRMED (heap object corrupted)
[B] child: victim ends at page boundary 0x800474000, guard at 0x800474000
[B] child killed by SIGSEGV => the i>=32 stores leave the object mapping
[B] RESULT: OOB WRITE PAST ALLOCATION CONFIRMED (kernel: past si_power_info kalloc end when table sits at object end)
[C] child: lowSMIO ends at 0x800474000, guard page at 0x800474000, count=255
[C] child killed by SIGSEGV at lowSMIO[32] => si_dpm.c:4505-4506 sink is OOB
[C] RESULT: SECOND SINK CONFIRMED (lowSMIO OOB read-modify-write; kernel object-end overrun for count>~154)
[D] with fix.diff clamp: ret=-1 (rejected oversized BIOS table), canary bytes hit=0, vddc.count=0
[D] RESULT: FIX VALIDATED at harness level (no OOB writes)

summary: A=1 B=1 C=1 (1=confirmed) D_fix_ok=1
EXIT=0