=== DF-4395: vega10 get_dcefclk_voltage_dependency_table OOB write ===
sizeof(phm_ppt_v1_clock_voltage_dependency_record)=28 (expect 28)

  [control  ] ucNumEntries=  6 num_entries(alloc)=  7 alloc=200 B, copy-loop writes through byte 172 -> 0 guard bytes SMASHED (guard intact)
  [n=9      ] ucNumEntries=  9 num_entries(alloc)=  8 alloc=228 B, copy-loop writes through byte 256 -> 5 guard bytes SMASHED >>> HEAP OVERFLOW CONFIRMED
  [n=255   ] ucNumEntries=255 num_entries(alloc)=8 alloc=228 B, copy-loop writes through byte 7144 -> 1233 guard bytes SMASHED >>> HEAP OVERFLOW CONFIRMED (6916 B past object)
             first OOB record: clk=0x000003f0 vddInd=8 (kernel heap gets VBIOS-chosen u32 dwords every 28 bytes)
  [dev!=6863] ucNumEntries=255 num_entries(alloc)=255 alloc=7144 B, copy-loop writes through byte 7144 -> 0 guard bytes SMASHED (guard intact)
  [rev=1    ] ucNumEntries=255 num_entries(alloc)=255 alloc=7144 B, copy-loop writes through byte 7144 -> 0 guard bytes SMASHED (guard intact)
  [PATCHED  ] ucNumEntries=255 num_entries(alloc)=  8 alloc=228 B, copy-loop writes through byte 7144 -> 0 guard bytes SMASHED (guard intact)

[+] DF-4395 CONFIRMED: pioneer path allocates min(ucNumEntries+1,8) records
    but copies ucNumEntries records -> linear heap OOB write,
    (ucNumEntries-8)*28 = up to 6916 bytes of VBIOS-controlled data.
RUN_EXIT=0