# DF-4346 — amdgpu atom_index_iio: unvalidated VBIOS opcode indexes 10-entry atom_iio_len[] (kernel .data OOB) and drives an unbounded walk past the BIOS image

`sys/dev/drm/amd/amdgpu/atom.c:1291` — `base += atom_iio_len[CU8(base)]`
with an opcode byte straight from the VBIOS (0..255) into the 10-entry
static `atom_iio_len[]` (atom.c:1280). Out-of-range opcodes read past
the array in kernel .data; the resulting stride walks the IIO table
past the bios allocation at driver attach. Amdgpu twin of DF-4338
(radeon), previously unfiled for this file.

## Reproduce (logic level — guest has no AMD GPU)

```
cc -O1 -g -o atom_harness atom_harness.c
./atom_harness iio          # opcode 200 -> atom_iio_len[200] -> SIGSEGV/139
./atom_harness_fixed iio    # op > ATOM_IIO_END -> clean stop, exit 0
```

See `run.log` case `iio` and `fix_run.log`. Kernel-runtime validation
requires an AMD card with crafted VBIOS (not emulatable in QEMU).

## Fix

`fix.diff` — bound the opcode before indexing (return on
`op > ATOM_IIO_END`); full bios_size-bounded walk in the DF-4345 port.