# DF-4339 — atom_parse name[] can stay unterminated and the msg string is walked unbounded

**Severity:** Low **Confidence:** certain **File:** sys/dev/drm/radeon/atom.c:1315-1326

## What

```c
char name[512];
str = CSTR(CU16(base + ATOM_ROM_MSG_PTR));      /* u16 ptr, unvalidated */
while (*str && ((*str == '\n') || (*str == '\r'))) str++;   /* unbounded skip */
for (i = 0; i < 511; i++) {
	name[i] = str[i];                       /* OOB read past bios alloc */
	if (name[i] < '.' || name[i] > 'z') { name[i] = 0; break; }
}
DRM_INFO("ATOM BIOS: %s\n", name);
```

Two defects:
1. If all 511 copied bytes are in [0x2E,0x7A] the loop finishes with
   i==511 and **name[511] is never written** — `name` is an uninitialized
   512-byte stack buffer, and `%s` then walks past name[510] through
   adjacent kernel stack until an incidental NUL, printing those bytes to
   the console/log.
2. `str` is walked (skip loop + 511-byte copy) with no bound against the
   bios allocation — OOB heap read when the msg pointer lands near the
   image end.

## Reproduce (logic level; kernel runtime needs ATOM hardware — env.txt)

```
cc -O1 -g -o atom_harness atom_harness.c
./atom_harness name      # -> Segmentation fault (str walk past image end)
./atom_harness name_nul  # -> strlen(name)=515: reads 4 bytes PAST name[511]
```

## Fix

`fix.diff` (git-apply checked): `char name[512] = { 0 };` — the buffer is
always NUL-terminated. The bios_size bound for the `str` walk comes from
DF-4337's central fix (atom_in_bios gates in atom_parse).