# DF-3650 — OOB read in ci_parse_power_table's VCE state fill: clk_idx (ucClockInfoIndex & 0x3f) indexes clockInfo[] without the ucNumEntries bound used everywhere else

File: `sys/dev/drm/radeon/ci_dpm.c` (pass 2, GLM 5.3 re-audit)
Severity: Medium  |  CWE-125 Out-of-bounds Read  |  confidence: certain

## Reproduce
This pack carries a userland logic harness (`harness.c`) built and run ON THE
AUDIT GUEST with the exact kernel types; decisive section: **[E]**

    ./build.sh
    ./run.sh

Expected decisive line:
    clk_idx=63 * entrySize=255 = 16065 bytes past clockInfo[0] (ucNumEntries=1)

The kernel code path itself requires a Sea Islands radeon GPU + crafted VBIOS;
the guest is virtio-only (no AMD PCI device, no /dev/dri, no drm kld) — see env.txt.

Full narrative: VERDICT.md. Proposed fix: fix.diff (authored against the read-only
sys/ tree; never applied there).