# DF-4352 — dce110_link_encoder_create indexes 7/6/6-entry const register tables with unvalidated VBIOS-derived transmitter/channel/hpd_source (DF-4312/4319 twin)

## Build / Run (guest model)
```
cc -O2 -Wall -o df4352 df4352.c
./df4352
```
Expected: `CONST-TABLE OOB READ CONFIRMED (model)` — 9 of 28 reachable
enum values index out of bounds:
- `link_enc_regs[transmitter]` (7 entries): TRANSMITTER_UNKNOWN(-1),
  TRAVIS_CRT(7), TRAVIS_LCD(8), UNIPHY_G(9)
- `link_enc_aux_regs[channel-1]` (6 entries): CHANNEL_ID_UNKNOWN(0)→[-1],
  DDC_VGA(7)→[6], I2C_PAD(8)→[7]
- `link_enc_hpd_regs[hpd_source]` (6 entries): COUNT(6), UNKNOWN(7)

## Root cause
dce110_resource.c:588-590 performs the three lookups with values sourced
at link bring-up from the VBIOS object tables (dc_link.c:1177-1183 —
get_ddc_line, get_hpd_line, translate_encoder_to_transmitter, each with
UNKNOWN defaults) and no bounds checks.  An OOB const read yields a
garbage register-offset struct that becomes the encoder's MMIO base for
every later register access — VBIOS-steerable wild MMIO.  Trust boundary
identical to DF-4216/DF-4312/DF-4319 (crafted/foreign VBIOS).

## Fix
`fix.diff` (git apply --check clean): bounds-check all three and return
NULL — the caller (dc_link.c:1187-1190) already fails the link cleanly
on NULL.