sizeof(ATOM_MEMORY_TIMING_FORMAT)=24 offsetof(asMemTiming)=32
usModuleSize=0xfff0 -> num_entries=168 ; mclk[] capacity=16
first OOB value (VBIOS u32 0x41410068) lands at struct offset 68 — i.e. exactly at the end of the 68-byte struct; total overflow 608 bytes past it
OOB u32 writes past mclk[16]: 152 (608 bytes) of attacker-chosen VBIOS data onto the caller kernel stack frame
note: run `./mclk_bin stack` to perform the overflow on the harness's own stack (crashes, as the kernel would)
REPRODUCED (harness): mclk[16] overflow via uncapped num_entries
exit_code=0