# DF-4347 — amdgpu VBIOS part-number string walked/printed past the BIOS image (`%s` + strlcpy on unterminated source)

`sys/dev/drm/amd/amdgpu/atom.c:1340-1348` — `idx = CU16(0x6E)` is an
unvalidated 16-bit VBIOS offset; `str = CSTR(idx)` is then passed to
`pr_info("ATOM BIOS: %s\n", str)` and `strlcpy(vbios_version, str, 20)`.
Both walk the source until a NUL that may live past the bios allocation:
kernel heap bytes end up in the console/log and (≤19 bytes) in
`ctx->vbios_version`. Amdgpu twin of DF-4339 (radeon), with a worse
shape (no bounded intermediate copy at all). Previously unfiled for
this file.

## Reproduce (logic level — guest has no AMD GPU)

```
cc -O1 -g -o atom_harness atom_harness.c
./atom_harness partstr       # string to image end, no NUL -> SIGSEGV/139
./atom_harness_fixed partstr # NUL-in-image required -> reject, exit 0
```

See `run.log` case `partstr`, `fix_run.log`. Kernel runtime needs an AMD
card with crafted VBIOS (not emulatable in QEMU).

## Fix

`fix.diff` — minimal bounded copy; full validation (idx in image + NUL
in image) in the central DF-4345 port.