################ BASELINE (verbatim production code) ################
===== [BASELINE] MODE layout =====
OFFSET_TO_ATOM_ROM_HEADER_POINTER = 0x48  OFFSET_TO_ATOM_ROM_IMAGE_SIZE = 0x2  BIOS_IMAGE_SIZE_UNIT = 512
claimed ceiling: bios[2]=0xFF -> 130560 bytes; rig allocation = 4096 bytes (delta 126464)
sizeof(struct atom_rom_header_v2_2) = 40 (masterdatatable_offset@32)
sizeof(struct atom_master_data_table_v2_1) = 74 (firmwareinfo@+12 dce_info@+58 displayobjectinfo@+48 smu_info@+20)
sizeof(struct display_object_info_table_v1_4) = 136
sizeof(struct atom_firmware_info_v3_2) = 72
sizeof(struct atom_display_controller_info_v4_1) = 56 (dce_refclk_10khz@12)
----- rc=0 -----
===== [BASELINE] MODE size-mismatch =====
[size-mismatch] true allocation = 4096 bytes, bios[2]=0xff claims 130560 bytes
    firmware_parser_create -> construct SUCCEEDED
    bp->base.bios_size = 130560 (bios_parser2.c:1930, from the image byte)
    true allocation     = 4096
    => DF-4168 CONFIRMED: bounds are the ATTACKER-CLAIMED size, 31x the allocation; every GET_IMAGE walk may read up to offset 130560
----- rc=1 -----
===== [BASELINE] MODE oob-guard =====
[rig] child: entering bios_parser_get_firmware_info (production bios_parser2.c:1119)
[rig] SIGSEGV reading 0x800475102 : fault offset in mapping = 4354 : allocation = 4096 bytes : bios_size (claimed) = 130560 => READ PAST THE HEAP ALLOCATION (kernel: OOB read past adev->bios kzalloc)
[oob-guard] allocation 4096 bytes ends at a PROT_NONE page; firmwareinfo@0x1100 dce_info@0x1300 (both past the allocation, inside the claimed 130560)
    firmware_parser_create -> construct SUCCEEDED (bios_size=130560); driving the firmware-info walk
    => child exited rc=88 from the SIGSEGV handler : OUT-OF-ALLOCATION READ in the production walk (kernel: OOB heap read)
----- rc=1 -----
===== [BASELINE] MODE oob-canary =====
[oob-canary] adjacent heap region prefilled 0x41; firmwareinfo@0x1100 dce_info@0x1300 crafted there (dce_refclk_10khz=0x1234)
    firmware_parser_create -> construct SUCCEEDED (bios_size=130560)
    running bios_parser_get_firmware_info in-process (no guard: proving the READ, not the fault)
    bios_parser_get_firmware_info -> BP_RESULT_OK
    pll_info.crystal_frequency = 46600 KHz
    default_engine_clk = 0  default_memory_clk = 222220
    dp_phy_ref_clk = 167050  i2c_engine_ref_clk = 10000
    => DF-4168 CONFIRMED: crystal_frequency 46600 came from dce_refclk_10khz=0x1234 at offset 0x1300 -- 768 bytes PAST the allocation
----- rc=1 -----
===== [BASELINE] MODE guard-construct =====
[rig] child: entering firmware_parser_create (production bios_parser2.c:1994) -> bios_parser_construct GET_IMAGE(struct atom_rom_header_v2_2, *0x48=0x2500)
[rig] SIGSEGV reading 0x800476502 : fault offset in mapping = 9474 : allocation = 4096 bytes : bios_size (claimed) = 130560 => READ PAST THE HEAP ALLOCATION (kernel: OOB read past adev->bios kzalloc)
[guard-construct] ROM-header pointer (image[0x48]) = 0x2500, past the 4096-byte allocation; claiming 130560
    => child exited rc=88 from the SIGSEGV handler : construct's OWN walk read past the allocation (bios_parser2.c:1942)
----- rc=1 -----

################ FIXED (same slice + DF-4168 fix.diff) ################
===== [FIXED] MODE layout =====
OFFSET_TO_ATOM_ROM_HEADER_POINTER = 0x48  OFFSET_TO_ATOM_ROM_IMAGE_SIZE = 0x2  BIOS_IMAGE_SIZE_UNIT = 512
claimed ceiling: bios[2]=0xFF -> 130560 bytes; rig allocation = 4096 bytes (delta 126464)
sizeof(struct atom_rom_header_v2_2) = 40 (masterdatatable_offset@32)
sizeof(struct atom_master_data_table_v2_1) = 74 (firmwareinfo@+12 dce_info@+58 displayobjectinfo@+48 smu_info@+20)
sizeof(struct display_object_info_table_v1_4) = 136
sizeof(struct atom_firmware_info_v3_2) = 72
sizeof(struct atom_display_controller_info_v4_1) = 56 (dce_refclk_10khz@12)
----- rc=0 -----
===== [FIXED] MODE size-mismatch =====
[size-mismatch] true allocation = 4096 bytes, bios[2]=0xff claims 130560 bytes
    firmware_parser_create -> construct SUCCEEDED
    bp->base.bios_size = 4096 (bios_parser2.c:1930, from the image byte)
    true allocation     = 4096
    => bios_size clamped to the allocation
----- rc=0 -----
===== [FIXED] MODE oob-guard =====
[rig] child: entering bios_parser_get_firmware_info (production bios_parser2.c:1119)
[oob-guard] allocation 4096 bytes ends at a PROT_NONE page; firmwareinfo@0x1100 dce_info@0x1300 (both past the allocation, inside the claimed 130560)
    firmware_parser_create -> construct SUCCEEDED (bios_size=4096); driving the firmware-info walk
    bios_parser_get_firmware_info -> BP_RESULT_BADBIOSTABLE
    info untouched (sentinel intact: yes), no table bytes parsed
[oob-guard] allocation 4096 bytes ends at a PROT_NONE page; firmwareinfo@0x1100 dce_info@0x1300 (both past the allocation, inside the claimed 130560)
    firmware_parser_create -> construct SUCCEEDED (bios_size=4096); driving the firmware-info walk
    => child exited rc=0, no fault
----- rc=0 -----
===== [FIXED] MODE oob-canary =====
[oob-canary] adjacent heap region prefilled 0x41; firmwareinfo@0x1100 dce_info@0x1300 crafted there (dce_refclk_10khz=0x1234)
    firmware_parser_create -> construct SUCCEEDED (bios_size=4096)
    running bios_parser_get_firmware_info in-process (no guard: proving the READ, not the fault)
    bios_parser_get_firmware_info -> BP_RESULT_BADBIOSTABLE
    info untouched (sentinel intact: yes), no table bytes parsed
----- rc=0 -----
===== [FIXED] MODE guard-construct =====
[rig] child: entering firmware_parser_create (production bios_parser2.c:1994) -> bios_parser_construct GET_IMAGE(struct atom_rom_header_v2_2, *0x48=0x2500)
[guard-construct] ROM-header pointer (image[0x48]) = 0x2500, past the 4096-byte allocation; claiming 130560
    construct rejected the image (GET_IMAGE returned NULL)
[guard-construct] ROM-header pointer (image[0x48]) = 0x2500, past the 4096-byte allocation; claiming 130560
    => child exited rc=0, no fault
----- rc=0 -----