# DF-4338 VERDICT

**Status: inconclusive (kernel runtime hardware-gated; logic-level OOB
reproduced on the audit guest). Defect: certain.**

## Root cause

atom.c:1254 `atom_iio_len[]` has 10 entries; atom.c:1265
`base += atom_iio_len[CU8(base)]` indexes it with an unvalidated VBIOS byte
(0..255). OOB read of static kernel data (.data adjacency), and the loaded
garbage stride drives the `while (CU8(base) != ATOM_IIO_END)` walk
unboundedly forward from the IIO table (atom.c:1264-1265) — through the rest
of the bios allocation and beyond. Called once per attach from
atom_parse (atom.c:1309). The amdgpu twin is identical
(amd/amdgpu/atom.c:1281-1293) and must be fixed in parallel.

## Reproduction

Guest has no ATI GPU (env.txt) → kernel path unrunnable. Logic-level PoC on
the guest: verbatim loop, `atom_iio_len` on a guard-page-backed mapping,
bios image 512 bytes with IIO opcode byte 200 at 0x42.

Result (run_cases.log): `iio` case → **Segmentation fault, exit 139**:
`atom_iio_len[200]` reads 800 bytes past the 10-int table. In-kernel the
same expression reads adjacent globals and then the walk continues with an
uncontrolled stride (hang or OOB walk until page fault).

## Fix validation (logic level)

fix.diff: `int op = CU8(base); if (op > ATOM_IIO_END) return;` before the
index. `git apply --check` OK. Fixed-logic harness (DF-4337's
atom_harness_fixed.c `iio` case) → "walk stopped cleanly on opcode 200",
exit 0 (fix_run.log in DF-4337/, same pack content).

Kernel-build/on-hardware validation not possible on this guest (no ATOM
hardware) → fix_status inconclusive.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.