# DF-3855 — ext-TMDS init parser desync: non-IGP `case 0` record missing `index += 4`

## Verdict (one line)
**CONFIRMED REAL by source trace + harness (well-formed stream misparsed);
security impact bounded (crafted-VBIOS attacker already controls the table);
NOT runnable on the audit guest (no radeon GPU) — `inconclusive`.**

## Build / run
```
./build.sh    # cc -O2 -Wall -o harness harness.c
./run.sh      # walks the same stream with buggy and fixed parsers
```

## Expected output
The stream is one well-formed case-0 record (write reg 4, value 0x55555555)
followed by the 0xffff terminator. The buggy kernel walk re-reads the value's
low half (0x5555) as the next command id → executes an unintended second
command, consumes the terminator as operand bytes, and runs past the end of
the record stream (feeding whatever follows — data or out-of-table bytes —
into WREG32):

```
  [non-IGP, buggy] ...
  case 0 (direct write): consumes 4-byte value but DOES NOT advance index
    WREG32(0x0004, 0x55555555)
  case 0 (direct write) ...            <- 0x5555 re-read as id: unintended
    WREG32(0x1554, 0xaaaaaaaa)         <- terminator consumed as operand
  buggy walk executed 2 MMIO write(s) and ran PAST the terminator ...
  [with index += 4 fix]:
    WREG32(0x0004, 0x55555555)
  fixed walk executed 1 MMIO write(s) and stopped at the terminator
```

## Notes
- Same-function contrast: the IGP branch of
  `radeon_combios_external_tmds_setup()` DOES advance (`radeon_combios.c:2903`).
- Upstream parity: Linux v5.10 radeon_combios.c:2965-2969 has the same
  missing advance — inherited, not a port regression.
- The out-of-table walk this desync causes is the DF-1251 family (no bounds
  vs bios allocation); THIS finding is the desync itself (in-bounds data
  executed as commands). Fixing it does not fix DF-1251 and vice versa.