DF-4352 model: dce110_link_encoder_create const-table index domains
lookup expressions verbatim from dce110_resource.c:588-590
table sizes: link_enc_regs=7, link_enc_aux_regs=6, link_enc_hpd_regs=6

link_enc_regs[transmitter]:
  OOB  transmitter              = -1   -> index -1 into 7-entry table
       value: TRANSMITTER_UNKNOWN (unrecognized encoder id)
  OOB  transmitter              = 7    -> index 7 into 7-entry table
       value: TRAVIS_CRT (external enc)
  OOB  transmitter              = 8    -> index 8 into 7-entry table
       value: TRAVIS_LCD (external enc)
  OOB  transmitter              = 9    -> index 9 into 7-entry table
       value: UNIPHY_G

link_enc_aux_regs[channel - 1]:
  OOB  channel-1                = -1   -> index -1 into 6-entry table
       value: CHANNEL_ID_UNKNOWN (default when no ddc pin)
  OOB  channel-1                = 6    -> index 6 into 6-entry table
       value: CHANNEL_ID_DDC_VGA (VGA connector)
  OOB  channel-1                = 7    -> index 7 into 6-entry table
       value: CHANNEL_ID_I2C_PAD (I2C pad connector)

link_enc_hpd_regs[hpd_source]:
  OOB  hpd_source               = 6    -> index 6 into 6-entry table
       value: HPD_SOURCEID_COUNT
  OOB  hpd_source               = 7    -> index 7 into 6-entry table
       value: HPD_SOURCEID_UNKNOWN (default: no HPD gpio)

9 of 28 reachable enum values index out of bounds
CONST-TABLE OOB READ CONFIRMED (model): each OOB case reads adjacent .rodata that becomes the encoder's MMIO register base (wild MMIO on every later REG_*)