# DF-3741 — Zero-stride VBIOS record walks cause infinite kernel loops (radeon_atom_init_mc_reg_table, atom_lookup_voltage_object_v3)

**Severity**: Medium · **CWE**: CWE-835 Loop with Unreachable Exit Condition · **File**: sys/dev/drm/radeon/radeon_atombios.c:4023-4045, 3423-3429

## What this is
Two BIOS-gated infinite loops (kernel hang at driver init / first DPM use): (1) radeon_atom_init_mc_reg_table():4023-4045 walks reg_data in usRegDataBlkSize strides; with a BIOS stride of 0 and mem-id mismatch, neither the END sentinel nor the num_ranges<VBIOS_MAX_AC_TIMING_ENTRIES cap can ever trigger — non-terminating loop; with a nonzero stride the walk scans unbounded past the VBIOS image heap until it stumbles on 0xFFFFFFFF (OOB read). (2) atom_lookup_voltage_object_v3():3423-3429 advances by the object's self-declared usSize; usSize==0 with a type/mode mismatch never advances — non-terminating. Harness on guest: both replicas fail to terminate within 2^24 iterations (the cap exists only in the harness); a stride-4 control with an END marker terminates in 3. Same source certainty as pass-1 class but distinct functions; no AMD hardware on this guest.

## Reproduce
```
./build.sh    # cc -O1 -g -Wall -o <bin> harness_hang.c   (DragonFly guest, cc 8.3)
./run.sh      # expected: both zero-stride walks hit the 2^24-iteration harness cap (non-termination); control terminates in 3; exit_code=0
```
The harness replicates the kernel parse arithmetic VERBATIM (cited path:line) against a
synthetic crafted-VBIOS buffer with canary-guarded destinations.

## Guest / environment
Guest has NO AMD/radeon GPU (virtio-only); /boot/kernel/radeon.ko exists (code shipped in the default install) but cannot attach, so the kernel code path is unreachable at runtime on this guest. Evidence is source-level certainty (path:line traced) plus a verbatim-arithmetic userland harness compiled and executed on the guest (build.log/run.log).
See env.txt (uname, cc, kldstat, /boot/kernel/radeon.ko presence).

## Fix
reject zero strides — see fix.diff (authored after verification; never applied to sys/).