# DF-3856 — BIOS-controlled shift counts ≥ 32 (undefined behavior) build GPIO/PLL write masks

## Verdict (one line)
**CONFIRMED REAL by source trace; harness shows the concrete misbehaviour on
the audit toolchain (count silently taken mod 32 → wrong masks). Kernel-side
effect hardware-gated — `inconclusive`.**

## Build / run
```
./build.sh    # cc -O2 -Wall -o harness harness.c
./run.sh      # prints correct vs UB shift results
```

## Expected output
```
[pll case1] shift_byte=3 -> shift=24: and_mask=0xffffff00 (correct byte lane)
[pll case1] shift_byte=4 -> shift=32: and_mask=0x0000ffff (UB! ... mod 32 -> count 0)
[gpio mask] tmp=9 -> 1<<tmp = 0x00000200 (intended single bit)
[gpio mask] tmp=32 -> 1<<tmp = 0x00000001 (UB! mod-32 -> bit 0; ...)
[gpio mask] tmp=200 -> 1<<tmp = 0x00000100 (UB! mod-32 -> bit 8)
```
(Exact UB output varies by compiler/arch — that is the point; C99 6.5.7p3.)

## Sites (all take an unchecked BIOS byte as shift count)
- `radeon_combios.c:3103-3108` `combios_parse_pll_table()` case 1:
  `shift = RBIOS8(offset) * 8` (0..2040) → `x << shift`, `~(0xff << shift)`
  → `WREG32_PLL(addr, tmp)` with a garbage-modified value.
- `radeon_combios.c:2752,2760` voltage gpio `mask = (1 << tmp)` →
  r100_pm_misc() RMW (see DF-3852 for the same record's register injection).
- `radeon_combios.c:654-658` i2c gpiopad masks `(1 << clk)`, `(1 << data)`.
- `radeon_combios.c:2673-2687` thermal-controller `(1 << clk_bit)`,
  `(1 << data_bit)`.

Impact: silently-wrong hardware programming (PLL read-modify-writes and GPIO
masks built from garbage); no trap, no runtime warning. Low severity on its
own; force-multiplier for the MMIO-injection findings above.