# DF-4104 — amdgpu atombios_encoders: LVDS_Info parsed at unvalidated VBIOS offset — fixed-struct reads go OOB of the BIOS heap buffer

File: `sys/dev/drm/amd/amdgpu/atombios_encoders.c` (pass 2)
Class: heap OOB read (CWE-125) via unvalidated firmware-table offset
Hardware gate: AMD GPU (any asic using this file: DCE8/10/11 amdgpu + the
`LVDS_Info` data-table walk). Source-level certainty.
Family: DF-3745 (radeon twin: "Connector/encoder object-table walks deref
unvalidated VBIOS offsets"), DF-1408.

## Build / Run
Hardware-gated; the audit QEMU guest has no AMD GPU (bochs vga only).
Source-level analysis. See VERDICT.md.

## Expected (on hardware, with a crafted VBIOS)
`amdgpu_atombios_encoder_get_lcd_info()` reads ~44 bytes
(sizeof(ATOM_LVDS_INFO) = 4-byte header + 28-byte DTD + 12 tail bytes) at
`bios + data_offset` where `data_offset` is a u16 taken verbatim from the
VBIOS master data table (`amdgpu_atom_parse_data_header`, atom.c:1384-1403,
performs NO comparison against the actual BIOS image size — `struct
atom_context` (atom.h:126-144) does not even carry a bios_size). The BIOS
buffer is sized from the ROM image length (amdgpu_bios.c:172-179 `len =
AMD_VBIOS_LENGTH(header); kmalloc(len)`, or amdgpu_read_bios kzalloc(size)).
A 32KB image declaring `LVDS_Info` at data_offset 0x7FF0 → the field reads
at atombios_encoders.c:2091-2131 run up to 0x801B — past the 32768-byte
allocation → OOB heap read of up to ~44 bytes; parsed values (panel timing,
`ucSS_Id`, `usModePatchTableOffset`) become driver state; at an allocation
boundary the unmapped tail faults (panic), otherwise silent read.

## Artifacts
- VERDICT.md, verdict.json (status: untested, hardware absent on guest)
- fix.diff — record the BIOS image size in struct atom_context and bound
  data_offset + sizeof(ATOM_LVDS_INFO) (and the record walk base) in
  get_lcd_info. Note: the *record walk* itself is already known DF-1380;
  this finding covers the fixed-field reads that execute even when
  usModePatchTableOffset == 0.