# VERDICT — DF-4166

**status: untested** (hardware-gated; guest has no AMD GPU — env.txt)
**expected impact: small OOB read (8 bytes) past the gpio_pin_lut table in the
VBIOS image heap buffer; derived MMIO register index/bitshift misprogram DDC/GPIO**

## Root cause
bios_parser2.c:367 `table_index = record->i2c_id & I2C_HW_LANE_MUX` (I2C_HW_LANE_MUX
= 0x0f, atomfirmware.h:597). The guard at :369 is `count < table_index`; the
skip-search case `count == table_index` falls through to `header->gpio_pin[table_index]`
at :374 (search loop) — unreachable there because the loop is skipped — and at
:401-405 (info->gpio_info.clk_a_register_index / clk_a_shift), which is executed
unconditionally. `gpio_pin` is the flexible tail of `atom_gpio_pin_lut_v2_1`
(atomfirmware.h:619-624, declared gpio_pin[8]); `count` entries are covered by
`structuresize`. Index == count reads 8 bytes past the covered region.

Fix: `count <= table_index` (fix.diff). Upstream Linux carries the same operator
in this era of the DAL code; the clamp is a one-character-class fix.

## Why untested
Guest pciconf: only bochs SVGA 0x1234:1111; no AMD device; dev.drm absent.
The DC bios parser never runs. Fix.diff authored from source; not build-validated.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.