{
  "finding_id": "DF-3740",
  "title": "Stack buffer overflow in radeon_atom_get_mclk_range_table via uncapped num_entries fill of mclk[16]",
  "verdict": "inconclusive",
  "impact": "none (not runtime-demonstrated; source-certain)",
  "reproduce": {
    "build": "./build.sh",
    "run": "./run.sh (after ./build.sh); optional: ./mclk_bin stack (performs the overflow on the harness frame)",
    "expected": "num_entries=168 vs mclk[16]; 152 OOB u32 writes (608 bytes) of VBIOS-chosen data; exit_code=0"
  },
  "kernel_refs": [
    "sys/dev/drm/radeon/radeon_atombios.c:3925-3946",
    "sys/dev/drm/radeon/cypress_dpm.c:1075-1089",
    "sys/dev/drm/radeon/radeon_mode.h:637-649",
    "sys/dev/drm/radeon/radeon.h:354"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "build.log",
    "build.sh",
    "env.txt",
    "harness_mclk.c",
    "run.log",
    "run.sh",
    "run.stack.log",
    "README.md",
    "VERDICT.md",
    "manifest.json",
    "verdict.json",
    "fix.diff"
  ]
}