{
  "finding_id": "DF-4338",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Code defect certain: atom_index_iio (atom.c:1264-1265) indexes the 10-entry static array atom_iio_len with an unvalidated VBIOS opcode byte (0..255) \u2014 an OOB read of kernel .data whose garbage value then drives an unbounded forward walk through/past the bios allocation at driver attach. Kernel runtime hardware-gated (guest has no ATI GPU); the verbatim loop mirrored on the guest with atom_iio_len on a guard page SIGSEGVs (exit 139) on opcode 200, proving the OOB index. Fix (opcode > ATOM_IIO_END check) is git-apply clean and the fixed-logic mirror stops cleanly.",
  "exploit_chain": "",
  "evidence": "run_cases.log [iio] Segmentation fault exit=139; VERDICT.md; DF-4337/fix_run.log iio fixed case (exit 0)",
  "kernel_refs": [
    "sys/dev/drm/radeon/atom.c:1254",
    "sys/dev/drm/radeon/atom.c:1264",
    "sys/dev/drm/radeon/atom.c:1309",
    "sys/dev/drm/amd/amdgpu/atom.c:1281"
  ],
  "poc_changes": "no seed; atom_iio_len relocated onto a guard-page mapping in the mirror so the OOB index traps instead of silently reading adjacent globals (declaration-only change, expression verbatim)",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "cc -O1 -g -o atom_harness atom_harness.c (on DragonFly guest)",
  "run_cmd": "./atom_harness iio  (expect SIGSEGV/139)",
  "code_hash": "25677f802601b62268f4d213ef9e2af03250f6c9a544bae5cd4cbfd214ffe6fe",
  "notes": "amdgpu twin identical (amd/amdgpu/atom.c:1281) \u2014 port required. The unbounded walk bound itself is provided by DF-4337s central atom_in_bios gate.",
  "recommended_fix": "Range-check the IIO opcode byte (op > ATOM_IIO_END -> stop) before indexing atom_iio_len[]",
  "fix_status": "inconclusive",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff git apply --check OK; fixed-logic mirror stops cleanly on opcode 200 (exit 0) where baseline traps (139). Kernel-runtime validation impossible on this guest (no ATOM hardware).",
  "fix_evidence": "fix.diff; DF-4337/fix_run.log iio case"
}