sizeof(ATOM_GPIO_I2C_ASSIGMENT) = 28 (kernel expects 28)
BIOS size field = 4092 -> num_indices = 146 (i2c_bus[16])
kernel-store rdev->i2c_bus[i] executed for i=0..145
OOB pointer writes past i2c_bus[16] : 130 (1040 bytes) into subsequent radeon_device fields
canary words corrupted in this model : 16
worst case size=0xFFFF -> num_indices = 2340 -> 2324 OOB pointer writes (18592 bytes)
REPRODUCED (harness): BIOS-count-driven write past i2c_bus[16] in radeon_device
exit_code=0