{
  "finding_id": "DF-4346",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Code defect certain: atom_index_iio (amd/amdgpu/atom.c:1291) indexes the 10-entry static atom_iio_len[] with an unvalidated VBIOS opcode byte (0..255) -- an OOB read of kernel .data whose garbage stride then drives an unbounded forward walk past the bios allocation at driver attach (atom.c:1287-1293, called from amdgpu_atom_parse at atom.c:1334). Byte-identical to the radeon twin DF-4338 fixed; previously unfiled for amdgpu. Kernel runtime hardware-gated (no AMD GPU on the guest); the verbatim loop mirrored on the guest with atom_iio_len at a guard page: opcode 200 -> SIGSEGV exit 139 (run.log case iio); fixed logic (op > ATOM_IIO_END -> return) stops cleanly, exit 0 (fix_run.log).",
  "exploit_chain": "",
  "evidence": "run.log case iio (exit=139 at atom_iio_len[200]); fix_run.log case iio (clean stop, exit 0); fix.diff (git apply --check OK)",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/atom.c:1280",
    "sys/dev/drm/amd/amdgpu/atom.c:1287",
    "sys/dev/drm/amd/amdgpu/atom.c:1291",
    "sys/dev/drm/amd/amdgpu/atom.c:1334"
  ],
  "poc_changes": "iio case carried in the shared amdgpu harness (guarded atom_iio_len, opcode 200)",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "cc -O1 -g -o atom_harness atom_harness.c",
  "run_cmd": "./atom_harness iio (expect 139) ; ./atom_harness_fixed iio (expect 0)",
  "code_hash": "5356b23349edbb49469348db664a12cf6437fa43fe980eef7d322939a6da7eba",
  "notes": "amdgpu twin of DF-4338; standalone opcode-bound fix included, full bios_size-bounded walk in the DF-4345 central port",
  "recommended_fix": "Validate the IIO opcode against ATOM_IIO_END before indexing atom_iio_len[] and bound the walk by the bios image length",
  "fix_status": "inconclusive",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff (standalone opcode bound, same shape as DF-4338s) passes git apply --check; fixed-logic mirror rejects opcode 200 without trapping. No kernel runtime possible on this guest.",
  "fix_evidence": "fix.diff; fix_run.log case iio"
}