# DF-3852 — COMBIOS voltage-GPIO register index injected into MMIO without range validation

## Verdict (one line)
**CONFIRMED REAL by source trace + harness primitive; kernel-side execution NOT
observable on the audit guest (virtio-only, no AMD/ATI GPU) — `inconclusive`.**

## Build / run
```
./build.sh    # cc -O2 -Wall -o harness harness.c
./run.sh      # prints the parsed gpio.reg and the resulting MMIO routing
```

## Expected output
The crafted COMBIOS powerplay record (misc bit 0x4 = ATOM_PM_MISCINFO_VOLTAGE_DROP_SUPPORT)
yields `gpio.reg = 0xffff * 4 = 0x3FFFC`. The `r100_pm_misc()` RMW then targets
offset 0x3FFFC — 3x past the 64 KB radeon MMIO BAR — which `r100_mm_wreg_slow()`
routes into `RADEON_MM_INDEX` as a raw indexed access. Harness prints:

```
[combios] VOLTAGE_GPIO parsed: gpio.reg=0x0003fffc ...
  [slow] WREG32: MM_INDEX <- 0x0003fffc (>= rmmio_size 0x10000) -> indexed write OUTSIDE the MMIO BAR
PRIMITIVE PROVEN: BIOS word 0xffff -> MMIO offset 0x3fffc >= rmmio_size 0x10000 ...
```

## What the harness is / is not
- IS: a 1:1 replication of the kernel parsing math
  (`radeon_combios.c:2748-2763`) and the sink semantics
  (`r100.c:352-364` RMW + `r100.c:4132-4138` slow-path routing).
- IS NOT: a kernel run. The audit guest has no radeon device, so the
  in-kernel MMIO write cannot be observed there. On real pre-AVIVO mobility
  hardware this executes at every PM clock transition
  (`radeon_pm.c:219/241 -> r100_pm_misc`).

## Reproduce on target hardware
Crafted COMBIOS image (see `harness.c` bytes): powerplay table, rev 5,
`misc = 0x0004`, gpio register word `0xFFFF`, mask bit `9`. Flash/replace the
VBIOS on an RS100–RS480/R100–R420-class mobility board (or supply via
PCI ROM BAR on a hotplug card), load radeonkms, trigger a PM transition
(suspend/resume or profile change). The GPU-side indexed access at 0x3FFFC
fires from `r100_pm_misc()`.