# DF-4122 verdict — No block-size floor for fixed per-panel-array BDB consumers: parse_edp/parse_psr/parse_lfp_backlight read up to ~350 bytes past short blocks

## Reproduced? — reproduced (leak)
Harness-reproduced (edp instance): a 74-byte crafted VBT, accepted by the verbatim intel_bios_is_valid_vbt(), declares BDB_EDP as the last block with size 1. The verbatim parse_edp read of edp->color_depth (+160) and power_seqs[panel_type] hits the guard page — SIGSEGV at +233 from the buffer base, exit 77, stable across 3 runs. parse_psr (:681) and parse_lfp_backlight (:317/:344) have the identical shape (per-panel arrays with no floor). Hardware/firmware-gated (crafted-VBT model), same class as the block-size validation upstream later added across these parsers.

## Root cause (path:line)
find_section() (intel_bios.c:77-106) only guarantees a located block's
DECLARED size fits within bdb_size; it does not check the block is large
enough for the struct parsed from it. A crafted VBT can declare BDB_EDP,
BDB_PSR or BDB_LVDS_BACKLIGHT with a size of 0..N bytes smaller than the
struct, so:
 - parse_edp (intel_bios.c:569) reads edp->color_depth at +160 and
   &edp->power_seqs[panel_type] (:582, +150 for panel_type 15) and
   fast_link_params[panel_type] (:583, up to +196) from a block that may be
   1 byte -> reads past the bdb end;
 - parse_psr (:681) reads psr_table[panel_type] (up to +96) the same way;
 - parse_lfp_backlight (:311 entry_size, :317 data[panel_type], :344
   level[panel_type]) — only the version>=191 extension is guarded
   (get_blocksize >= sizeof(*backlight_data) at :327-328), which proves the
   pattern was known but never applied to the other reads;
 - parse_sdvo_panel_data (:370) and parse_general_features/parse_driver_features
   scalar reads share the pattern.
When the short block is the last one and bdb_size spans to the end of the
validated buffer, these are OOB reads past the kmemdup'd
i915_vbt_firmware heap allocation (exact-size kmemdup at
intel_opregion.c:942) or past the opregion RVDA mapping (pmap_mapbios(rvda,
rvds), intel_opregion.c:1031).

## Chain
crafted VBT with short BDB_EDP/BDB_PSR/BDB_LVDS_BACKLIGHT as last block -> find_section accepts any declared size that fits bdb -> parse_edp/parse_psr/parse_lfp_backlight struct reads run past bdb end -> OOB read past heap (firmware VBT) or mapping (opregion/ROM)

## Kernel refs
- sys/dev/drm/i915/intel_bios.c:569
- sys/dev/drm/i915/intel_bios.c:582
- sys/dev/drm/i915/intel_bios.c:681
- sys/dev/drm/i915/intel_bios.c:317
- sys/dev/drm/i915/intel_bios.c:327
- sys/dev/drm/i915/intel_bios.c:344
- sys/dev/drm/i915/intel_bios.c:96
- sys/dev/drm/i915/intel_opregion.c:942
- sys/dev/drm/i915/intel_opregion.c:1031

## Fix
Fail-closed floors matching exactly what each parser reads unconditionally (upstream later did the same across these blocks). Harness -p mode implements the edp floor (164) and rejects the 1-byte block without any struct read (fix_run.log).

fix.diff applies cleanly against the read-only sys/ tree (2-file for DF-4125; note the
radeon_pm.c hunk also needs `dpm_failed_unlock: mutex_unlock(&rdev->pm.mutex);` added to
the existing dpm_failed label path — spelled out here since the label does not exist in
the unfixed tree). Kernel-level fix validation is not possible on this guest (no
i915/RV6xx devices; the drivers never attach in QEMU); harness-level fix validation IS included: the -p runs exercise the patched parse logic against the identical crafted input and exit 0 (fix_run.log).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.