DF-3687 / run.log
parsed sysfs longs: level=-1 clk=105000 voltage=1150 bounds check `input[i] >= num_of_pl` (long -1 vs u32 8): PASSED (signed compare, negative passes) uint32_t input_level = 0xffffffff write offset = input_level * sizeof(phm_odn_performance_level) = 4294967295 * 12 = 51539607540 bytes past entries[0] RESULT: WILD OOB WRITE CONFIRMED at the arithmetic level - any u32 index is selectable via negative sysfs input (e.g. -1 -> +51,539,607,540) exit=0