# DF-3644 — Heap OOB write in ci_get_svi2_voltage_table: VBIOS dependency-table count (u8, up to 255) copied into fixed entries[32] before any trim

File: `sys/dev/drm/radeon/ci_dpm.c` (pass 2, GLM 5.3 re-audit)
Severity: High  |  CWE-787 Out-of-bounds Write  |  confidence: certain

## Reproduce
This pack carries a userland logic harness (`harness.c`) built and run ON THE
AUDIT GUEST with the exact kernel types; decisive section: **[A]**

    ./build.sh
    ./run.sh

Expected decisive line:
    OOB write of 1344 bytes past entries[32]; canary clobbered: YES

The kernel code path itself requires a Sea Islands radeon GPU + crafted VBIOS;
the guest is virtio-only (no AMD PCI device, no /dev/dri, no drm kld) — see env.txt.

Full narrative: VERDICT.md. Proposed fix: fix.diff (authored against the read-only
sys/ tree; never applied there).