# DF-3649 — Wild OOB kernel read in ci_get_std_voltage_value_sidd when the CAC leakage table count is 0: idx = (u16)(count-1) = 65535 past a ZERO_LENGTH_PTR that passes the entries!=NULL guard

File: `sys/dev/drm/radeon/ci_dpm.c` (pass 2, GLM 5.3 re-audit)
Severity: Medium  |  CWE-191 Integer Underflow / CWE-125 Out-of-bounds Read  |  confidence: certain

## Reproduce
This pack carries a userland logic harness (`harness.c`) built and run ON THE
AUDIT GUEST with the exact kernel types; decisive section: **[D]**

    ./build.sh
    ./run.sh

Expected decisive line:
    count=0 -> idx=65535; wild read address 0x7fff0 (unmapped)

The kernel code path itself requires a Sea Islands radeon GPU + crafted VBIOS;
the guest is virtio-only (no AMD PCI device, no /dev/dri, no drm kld) — see env.txt.

Full narrative: VERDICT.md. Proposed fix: fix.diff (authored against the read-only
sys/ tree; never applied there).