# DF-3739 — BIOS-count-driven OOB pointer write past rdev->i2c_bus[16] in radeon_atombios_i2c_init

**Severity**: High · **CWE**: CWE-787 Out-of-bounds Write · **File**: sys/dev/drm/radeon/radeon_atombios.c:172-187

## What this is
Source-certain heap-corruption write in the radeon ATOM I2C init path. atom_parse_data_header() (atom.c:1366-1385) returns the GPIO_I2C_Info table's self-declared u16 size with NO validation; radeon_atombios_i2c_init() derives num_indices=(size-4)/28 (up to 2340 with size=0xFFFF) and stores radeon_i2c_create() heap pointers into rdev->i2c_bus[i] (radeon.h:2440) whose capacity is RADEON_MAX_I2C_BUS=16 (radeon_mode.h:96). i2c.valid is BIOS-controlled (usClkMaskRegisterIndex!=0, :113-116), so every OOB store is attacker-gated. Entries 16..num_indices-1 overwrite the following radeon_device fields (debugfs[32], debugfs_count, vm_manager, gpu_clock_mutex, atif/atcs, ... radeon.h:2441+). Harness on guest: size=4092 -> 146 entries -> 130 OOB pointer writes (1040 B); worst case 0xFFFF -> 2324 OOB writes (18.5 KB). Not executable in-kernel on this guest (no AMD GPU); module present in /boot/kernel/radeon.ko.

## Reproduce
```
./build.sh    # cc -O1 -g -Wall -o <bin> harness_i2c.c   (DragonFly guest, cc 8.3)
./run.sh      # expected: num_indices=146 vs i2c_bus[16]; 130 OOB pointer writes (1040 bytes); worst case 2324 (18592 bytes); exit_code=0
```
The harness replicates the kernel parse arithmetic VERBATIM (cited path:line) against a
synthetic crafted-VBIOS buffer with canary-guarded destinations.

## Guest / environment
Guest has NO AMD/radeon GPU (virtio-only); /boot/kernel/radeon.ko exists (code shipped in the default install) but cannot attach, so the kernel code path is unreachable at runtime on this guest. Evidence is source-level certainty (path:line traced) plus a verbatim-arithmetic userland harness compiled and executed on the guest (build.log/run.log).
See env.txt (uname, cc, kldstat, /boot/kernel/radeon.ko presence).

## Fix
cap the loop at RADEON_MAX_I2C_BUS — see fix.diff (authored after verification; never applied to sys/).