################ BASELINE (verbatim production code) ################
===== [BASELINE] MODE layout =====
sizeof(ATOM_Vega10_POWERPLAYTABLE)=86
sizeof(ATOM_Vega10_State)=14 State_Array.states=+2
sizeof(GFXCLK rec V1)=9 V2=13
sizeof(CLK rec)=5  MCLK rec=7  MM rec=17  PCIE rec=6  lookup rec=2
sizeof(fan V1)=34 V2=35  thermal=8
sizeof(PowerTune V1)=41 V2=38 V3=54  hard-limit rec=18
kernel dest: dep rec=28  mm rec=32  pcie rec=12  voltage-lookup rec=10
offsetof(POWERPLAYTABLE,usStateArrayOffset)=48
MODE layout DONE rc=0
----- exit=0 -----
===== [BASELINE] MODE clean-valid =====
clean-valid: rc=0 image_len=339
  ti->mm_dep_table && ti->mm_dep_table->count == 1 OK
  ti->tdp_table && ti->tdp_table->usTDC == 240 OK
  ti->vdd_dep_on_socclk && ti->vdd_dep_on_socclk->count == 2 OK
  ti->vdd_dep_on_sclk && ti->vdd_dep_on_sclk->count == 2 OK
  ti->vdd_dep_on_pixclk && ti->vdd_dep_on_pixclk->count == 1 OK
  ti->vdd_dep_on_phyclk && ti->vdd_dep_on_phyclk->count == 1 OK
  ti->vdd_dep_on_dispclk && ti->vdd_dep_on_dispclk->count == 1 OK
  ti->vdd_dep_on_dcefclk && ti->vdd_dep_on_dcefclk->count == 2 OK
  ti->vdd_dep_on_mclk && ti->vdd_dep_on_mclk->count == 1 OK
  ti->pcie_table && ti->pcie_table->count == 1 OK
  ti->max_clock_voltage_on_dc.sclk == 100000 OK
  ti->valid_socclk_values && ti->valid_socclk_values->count == 2 OK
  ti->valid_sclk_values && ti->valid_sclk_values->count == 2 OK
  ti->vddc_lookup_table && ti->vddc_lookup_table->count == 4 OK
  ti->vddmem_lookup_table && ti->vddmem_lookup_table->count == 2 OK
  ti->vddci_lookup_table && ti->vddci_lookup_table->count == 2 OK
  g_hwmgr.thermal_controller.ucType == ATOM_VEGA10_PP_THERMALCONTROLLER_VEGA10 OK
  g_hwmgr.thermal_controller.advanceFanControlParameters.usTMax == 85 OK
  g_hwmgr.platform_descriptor.overdriveLimit.engineClock == 163000 OK
  n == 2                                     OK
  callback: flags=0x00000800 state_entry=image+88
  rc2 == 0 && g_cb_count == 1                OK
  g_cb_flags == PP_StateClassificationFlag_ACPI OK
clean-valid: ALL CHECKS OK
MODE clean-valid DONE rc=0
----- exit=0 -----
===== [BASELINE] MODE statearray-offset-oob =====
statearray-offset-oob: usStateArrayOffset=0xFF00 image=128B -> check_powerplay_tables:82 reads ucNumEntries at image+0xFF02
PREDICTED: SIGSEGV at image+65282 (+65154 past image end)
statearray-offset-oob: image_len=128 (guard page at image end)
FAULT: sigsegv addr=0x80048ae81
  image: base=0x80047af80 claimed_len=128 end=0x80047b000  addr-base=+65281  addr-image_end=+65153
  (address past image end: OUT-OF-BOUNDS access past the table image)
FAULT-END exit=77
----- exit=77 -----
===== [BASELINE] MODE numentries-offset-oob =====
numentries-offset-oob: direct vega10_get_number_of_powerplay_table_entries call (production: hwmgr backend init)
PREDICTED: SIGSEGV at image+0xFF02 (:1249, zero validation)
FAULT: sigsegv addr=0x80048ae81
  image: base=0x80047af80 claimed_len=128 end=0x80047b000  addr-base=+65281  addr-image_end=+65153
  (address past image end: OUT-OF-BOUNDS access past the table image)
FAULT-END exit=77
----- exit=77 -----
===== [BASELINE] MODE thermal-offset-oob =====
thermal-offset-oob: usThermalControllerOffset=0xFF00 -> init_thermal_controller:134 ucType read
PREDICTED: SIGSEGV at image+0xFF00
thermal-offset-oob: image_len=124 (guard page at image end)
FAULT: sigsegv addr=0x80048ae85
  image: base=0x80047af84 claimed_len=124 end=0x80047b000  addr-base=+65281  addr-image_end=+65157
  (address past image end: OUT-OF-BOUNDS access past the table image)
FAULT-END exit=77
----- exit=77 -----
===== [BASELINE] MODE fan-v2-tail =====
fan-v2-tail: fan header ucRevId=11 is the last image byte; V2 ucFanParameters at +32, usFanStartTemperature at +31
PREDICTED: SIGSEGV at image_end+32 (:214 first V2 deref)
fan-v2-tail: image_len=125 (guard page at image end)
FAULT: sigsegv addr=0x80047b01f
  image: base=0x80047af83 claimed_len=125 end=0x80047b000  addr-base=+156  addr-image_end=+31
  (address past image end: OUT-OF-BOUNDS access past the table image)
FAULT-END exit=77
----- exit=77 -----
===== [BASELINE] MODE od-acg-count-255 =====
od-acg-count-255: gfxclk rev1 ucNumEntries=255, 1 record in image -> init_over_drive_limits:273 patom_record_v2[254].ucACGEnable at gfx+2+254*13+9
PREDICTED: SIGSEGV at image_end+3297 (DF-1589 site)
od-acg-count-255: image_len=139 (guard page at image end)
FAULT: sigsegv addr=0x80047bce2
  image: base=0x80047af75 claimed_len=139 end=0x80047b000  addr-base=+3437  addr-image_end=+3298
  (address past image end: OUT-OF-BOUNDS access past the table image)
FAULT-END exit=77
----- exit=77 -----
===== [BASELINE] MODE gfxclk-v1-count-255 =====
gfxclk-v1-count-255: rev0 ucNumEntries=255, 1 record -> get_gfxclk_voltage_dependency_table:620 walk entries[i]
PREDICTED: SIGSEGV at image_end+0 (read of entries[1])
gfxclk-v1-count-255: image_len=135 (guard page at image end)
FAULT: sigsegv addr=0x80047b004
  image: base=0x80047af79 claimed_len=135 end=0x80047b000  addr-base=+139  addr-image_end=+4
  (address past image end: OUT-OF-BOUNDS access past the table image)
FAULT-END exit=77
----- exit=77 -----
===== [BASELINE] MODE socclk-count-255 =====
socclk-count-255: ucNumEntries=255 with 2 record(s) in image -> count-driven source copy loop reads past image
PREDICTED: SIGSEGV at image_end+0
socclk-count-255: image_len=136 (guard page at image end)
FAULT: sigsegv addr=0x80047b004
  image: base=0x80047af78 claimed_len=136 end=0x80047b000  addr-base=+140  addr-image_end=+4
  (address past image end: OUT-OF-BOUNDS access past the table image)
FAULT-END exit=77
----- exit=77 -----
===== [BASELINE] MODE mclk-count-255 =====
mclk-count-255: ucNumEntries=255 with 2 record(s) in image -> count-driven source copy loop reads past image
PREDICTED: SIGSEGV at image_end+0
mclk-count-255: image_len=140 (guard page at image end)
FAULT: sigsegv addr=0x80047b004
  image: base=0x80047af74 claimed_len=140 end=0x80047b000  addr-base=+144  addr-image_end=+4
  (address past image end: OUT-OF-BOUNDS access past the table image)
FAULT-END exit=77
----- exit=77 -----
===== [BASELINE] MODE mm-count-255 =====
mm-count-255: ucNumEntries=255 with 1 record(s) in image -> count-driven source copy loop reads past image
PREDICTED: SIGSEGV at image_end+0
mm-count-255: image_len=143 (guard page at image end)
FAULT: sigsegv addr=0x80047b000
  image: base=0x80047af71 claimed_len=143 end=0x80047b000  addr-base=+143  addr-image_end=+0
  (address past image end: OUT-OF-BOUNDS access past the table image)
FAULT-END exit=77
----- exit=77 -----
===== [BASELINE] MODE pixclk-count-255 =====
pixclk-count-255: ucNumEntries=255 with 2 record(s) in image -> count-driven source copy loop reads past image
PREDICTED: SIGSEGV at image_end+0
pixclk-count-255: image_len=136 (guard page at image end)
FAULT: sigsegv addr=0x80047b004
  image: base=0x80047af78 claimed_len=136 end=0x80047b000  addr-base=+140  addr-image_end=+4
  (address past image end: OUT-OF-BOUNDS access past the table image)
FAULT-END exit=77
----- exit=77 -----
===== [BASELINE] MODE powertune-v3-short =====
powertune-v3-short: rev=7 (V3 dispatch) with a 38-byte (V2-sized) table in image; V3 usBoostStartTemperature at +38
PREDICTED: SIGSEGV at image_end+0 (:488)
powertune-v3-short: image_len=162 (guard page at image end)
FAULT: sigsegv addr=0x80047b000
  image: base=0x80047af5e claimed_len=162 end=0x80047b000  addr-base=+162  addr-image_end=+0
  (address past image end: OUT-OF-BOUNDS access past the table image)
FAULT-END exit=77
----- exit=77 -----
===== [BASELINE] MODE hardlimit-tail =====
hardlimit-tail: header claims 1 entry, no record bytes -> get_hard_limits:814 entries[0].ulSOCCLKLimit
PREDICTED: SIGSEGV at image_end+0
hardlimit-tail: image_len=126 (guard page at image end)
FAULT: sigsegv addr=0x80047b000
  image: base=0x80047af82 claimed_len=126 end=0x80047b000  addr-base=+126  addr-image_end=+0
  (address past image end: OUT-OF-BOUNDS access past the table image)
FAULT-END exit=77
----- exit=77 -----
===== [BASELINE] MODE pcie-null-sclk =====
pcie-null-sclk: pcie table present, gfxclk offset 0 -> get_pcie_table:781 table_info->vdd_dep_on_sclk->count
PREDICTED: SIGSEGV at NULL (DF-1587)
pcie-null-sclk: image_len=132 (guard page at image end)
FAULT: sigsegv addr=0x0
  image: base=0x80047af7c claimed_len=132 end=0x80047b000  addr-base=-34364436348  addr-image_end=-34364436480
  (address below image base: NULL/near-NULL DEREFERENCE)
FAULT-END exit=77
----- exit=77 -----
===== [BASELINE] MODE dcefclk-pioneer-write =====
dcefclk-pioneer-write: dev 0x6863 rev 0, ucNumEntries=255 all in image, last ulClk<90000 -> pioneer path:
  alloc = 4 + NUM_DSPCLK_LEVELS(8)*28 = 228 bytes, copy loop runs ucNumEntries=255 (:740)
PREDICTED: SIGSEGV on first write past the 228-byte object (entries[8] at +232)
dcefclk-pioneer-write: image_len=1401 (guard page at image end)
FAULT: sigsegv addr=0x800494004
  image: base=0x80047aa87 claimed_len=1401 end=0x80047b000  addr-base=+103805  addr-image_end=+102404
  (address past image end: OUT-OF-BOUNDS access past the table image)
  nearest kzalloc'd object: 0x800493f1c len=228  addr-obj=+232  (object spans [0,228]; PAST the object end -> heap OUT-OF-BOUNDS WRITE)
FAULT-END exit=77
----- exit=77 -----
===== [BASELINE] MODE dcefclk-pioneer-canary =====
dcefclk-pioneer-canary: dev 0x6863 rev 0, ucNumEntries=255 all in image, last ulClk<90000 -> pioneer path:
  alloc = 4 + NUM_DSPCLK_LEVELS(8)*28 = 228 bytes, copy loop runs ucNumEntries=255 (:740)
PREDICTED: no fault; canary shows ~6916 bytes attacker-controlled overwrite
dcefclk-pioneer-canary: image_len=1401 (guard page at image end)
dcefclk-pioneer-canary: rc=0 (returned without fault)
  canary: obj len=232 at 0x8004bdc00 -> changed=0 bytes past object, range [+0,+0] (intact)
  canary: obj len=228 at 0x8004bb800 -> changed=1232 bytes past object, range [+0,+6892]  (OUT-OF-BOUNDS WRITE past kzalloc'd object)
  canary: obj len=36 at 0x8004b9400 -> changed=0 bytes past object, range [+0,+0] (intact)
  vdd_dep_on_dcefclk->count=8 (pioneer path stores 8 either way; the baseline copy loop still runs 255 and overwrites the 228-byte object, fixed loop runs 8)
MODE dcefclk-pioneer-canary DONE rc=0
----- exit=0 -----
===== [BASELINE] MODE vddc-lookup-write =====
vddc-lookup-write: ucNumEntries=255, max_levels=8 -> alloc 4+8*10=84 bytes, loop copies 255 (:1036) DF-1586
PREDICTED: SIGSEGV on first OOB write (entries[8].us_vdd at obj+86, object len 84)
vddc-lookup-write: image_len=636 (guard page at image end)
FAULT: sigsegv addr=0x800494002
  image: base=0x80047ad84 claimed_len=636 end=0x80047b000  addr-base=+103038  addr-image_end=+102402
  (address past image end: OUT-OF-BOUNDS access past the table image)
  nearest kzalloc'd object: 0x800493fac len=84  addr-obj=+86  (object spans [0,84]; PAST the object end -> heap OUT-OF-BOUNDS WRITE)
FAULT-END exit=77
----- exit=77 -----
===== [BASELINE] MODE vddc-lookup-canary =====
vddc-lookup-canary: ucNumEntries=255, max_levels=8 -> alloc 4+8*10=84 bytes, loop copies 255 (:1036) DF-1586
PREDICTED: no fault; canary shows strided 2-byte writes at +4+10i+2 for i=8..254, values == image bytes
vddc-lookup-canary: image_len=636 (guard page at image end)
vddc-lookup-canary: rc=0 (returned without fault)
  canary: obj len=232 at 0x8004bdc00 -> changed=0 bytes past object, range [+0,+0] (intact)
  canary: obj len=84 at 0x8004bb800 -> changed=494 bytes past object, range [+2,+2463]  (OUT-OF-BOUNDS WRITE past kzalloc'd object)
  overwrite provenance: 247/247 OOB us_vdd writes byte-exact equal to crafted image bytes, 0 mismatch
  vddc_lookup_table->count=255 (baseline overflows the 84-byte object with 247 more writes; fixed clamps loop to 8)
MODE vddc-lookup-canary DONE rc=0
----- exit=0 -----
===== [BASELINE] MODE gfxclk-v2-leak =====
gfxclk-v2-leak: rev1 ucNumEntries=40, 2 records in image (last in-image acg=0, OOB acg byte=0x34), victim bytes after image end
PREDICTED baseline: no fault; entries[2..39] values byte-exact with victim bytes; od engineClock decided by the OOB ACG byte (0) -> 198000
PREDICTED fixed:    count clamped to 2; engineClock decided by in-image rec1 acg (1) -> 200000
gfxclk-v2-leak: rc=0 image_len=152
  od: entries[39].ucACGEnable at image+642 (image_len=152) -> OOB victim byte 0x34, in-image rec1 byte 0x00; engineClock=200000 (OOB-expect 200000, in-image-expect 198000) => decision bit == OOB byte (LEAK)
  vdd_dep_on_sclk->count=40 (image holds 2)
  V2-walk provenance: 38 OOB records byte-exact with the bytes past the image (0 mismatch) -> values surface to userland via powerplay sysfs
MODE gfxclk-v2-leak DONE rc=0
----- exit=0 -----
===== [BASELINE] MODE socclk-leak-canary =====
socclk-leak-canary: ucNumEntries=40, 5 records in image, victim bytes after image end (DF-4247 leak-canary class)
socclk-leak-canary: rc=0 image_len=151
  vdd_dep_on_socclk->count=40 (image holds 5)
  leak provenance: 35/35 OOB records byte-exact with bytes past the image (0 mismatch)
MODE socclk-leak-canary DONE rc=0
----- exit=0 -----
===== [BASELINE] MODE result-clobber =====
result-clobber: vddc lookup fails (count=0 -> returns 1), vddmem/vddci succeed -> init_dpm_2_parameters:1103-1128 overwrites result
amdgpu: [powerplay] Invalid SOC_VDDD Lookup Table!
result-clobber: rc=0 vddc_lookup_table=0x0 vddmem=0x8004c06c0 vddci=0x8004c0690
  MASKED FAILURE PROVEN: parse 'succeeds' (rc=0) with NULL vddc_lookup_table -> consumer NULL-deref (DF-3702 class)
MODE result-clobber DONE rc=0
----- exit=0 -----
===== [BASELINE] MODE entry-offbyone =====
entry-offbyone: entry_index==ucNumEntries==2 passes the '<=' check (:1308) -> states[2].usClassification read at image_end+8 (DF-1588)
PREDICTED (baseline): SIGSEGV at image_end+8; (fixed: rc=-1)
FAULT: sigsegv addr=0x80047b00c
  image: base=0x80047af8c claimed_len=116 end=0x80047b000  addr-base=+128  addr-image_end=+12
  (address past image end: OUT-OF-BOUNDS access past the table image)
FAULT-END exit=77
----- exit=77 -----

################ FIXED (same slice + DF-4396 fix.diff) ################
===== [FIXED] MODE layout =====
sizeof(ATOM_Vega10_POWERPLAYTABLE)=86
sizeof(ATOM_Vega10_State)=14 State_Array.states=+2
sizeof(GFXCLK rec V1)=9 V2=13
sizeof(CLK rec)=5  MCLK rec=7  MM rec=17  PCIE rec=6  lookup rec=2
sizeof(fan V1)=34 V2=35  thermal=8
sizeof(PowerTune V1)=41 V2=38 V3=54  hard-limit rec=18
kernel dest: dep rec=28  mm rec=32  pcie rec=12  voltage-lookup rec=10
offsetof(POWERPLAYTABLE,usStateArrayOffset)=48
MODE layout DONE rc=0
----- exit=0 -----
===== [FIXED] MODE clean-valid =====
clean-valid: rc=0 image_len=339
  ti->mm_dep_table && ti->mm_dep_table->count == 1 OK
  ti->tdp_table && ti->tdp_table->usTDC == 240 OK
  ti->vdd_dep_on_socclk && ti->vdd_dep_on_socclk->count == 2 OK
  ti->vdd_dep_on_sclk && ti->vdd_dep_on_sclk->count == 2 OK
  ti->vdd_dep_on_pixclk && ti->vdd_dep_on_pixclk->count == 1 OK
  ti->vdd_dep_on_phyclk && ti->vdd_dep_on_phyclk->count == 1 OK
  ti->vdd_dep_on_dispclk && ti->vdd_dep_on_dispclk->count == 1 OK
  ti->vdd_dep_on_dcefclk && ti->vdd_dep_on_dcefclk->count == 2 OK
  ti->vdd_dep_on_mclk && ti->vdd_dep_on_mclk->count == 1 OK
  ti->pcie_table && ti->pcie_table->count == 1 OK
  ti->max_clock_voltage_on_dc.sclk == 100000 OK
  ti->valid_socclk_values && ti->valid_socclk_values->count == 2 OK
  ti->valid_sclk_values && ti->valid_sclk_values->count == 2 OK
  ti->vddc_lookup_table && ti->vddc_lookup_table->count == 4 OK
  ti->vddmem_lookup_table && ti->vddmem_lookup_table->count == 2 OK
  ti->vddci_lookup_table && ti->vddci_lookup_table->count == 2 OK
  g_hwmgr.thermal_controller.ucType == ATOM_VEGA10_PP_THERMALCONTROLLER_VEGA10 OK
  g_hwmgr.thermal_controller.advanceFanControlParameters.usTMax == 85 OK
  g_hwmgr.platform_descriptor.overdriveLimit.engineClock == 163000 OK
  n == 2                                     OK
  callback: flags=0x00000800 state_entry=image+88
  rc2 == 0 && g_cb_count == 1                OK
  g_cb_flags == PP_StateClassificationFlag_ACPI OK
clean-valid: ALL CHECKS OK
MODE clean-valid DONE rc=0
----- exit=0 -----
===== [FIXED] MODE statearray-offset-oob =====
statearray-offset-oob: usStateArrayOffset=0xFF00 image=128B -> check_powerplay_tables:82 reads ucNumEntries at image+0xFF02
PREDICTED: SIGSEGV at image+65282 (+65154 past image end)
statearray-offset-oob: image_len=128 (guard page at image end)
amdgpu: [powerplay] State array out of range!
amdgpu: [powerplay] check_powerplay_tables failed
statearray-offset-oob: rc=-1 (returned without fault)
MODE statearray-offset-oob DONE rc=-1
----- exit=255 -----
===== [FIXED] MODE numentries-offset-oob =====
numentries-offset-oob: direct vega10_get_number_of_powerplay_table_entries call (production: hwmgr backend init)
PREDICTED: SIGSEGV at image+0xFF02 (:1249, zero validation)
amdgpu: [powerplay] Invalid PowerPlay Table State Array Offset.
numentries-offset-oob: returned -1 without fault
MODE numentries-offset-oob DONE rc=0
----- exit=0 -----
===== [FIXED] MODE thermal-offset-oob =====
thermal-offset-oob: usThermalControllerOffset=0xFF00 -> init_thermal_controller:134 ucType read
PREDICTED: SIGSEGV at image+0xFF00
thermal-offset-oob: image_len=124 (guard page at image end)
amdgpu: [powerplay] Thermal controller table out of range!
amdgpu: [powerplay] init_thermal_controller failed
thermal-offset-oob: rc=-22 (returned without fault)
MODE thermal-offset-oob DONE rc=-22
----- exit=234 -----
===== [FIXED] MODE fan-v2-tail =====
fan-v2-tail: fan header ucRevId=11 is the last image byte; V2 ucFanParameters at +32, usFanStartTemperature at +31
PREDICTED: SIGSEGV at image_end+32 (:214 first V2 deref)
fan-v2-tail: image_len=125 (guard page at image end)
amdgpu: [powerplay] Fan table out of range!
amdgpu: [powerplay] init_thermal_controller failed
fan-v2-tail: rc=-22 (returned without fault)
MODE fan-v2-tail DONE rc=-22
----- exit=234 -----
===== [FIXED] MODE od-acg-count-255 =====
od-acg-count-255: gfxclk rev1 ucNumEntries=255, 1 record in image -> init_over_drive_limits:273 patom_record_v2[254].ucACGEnable at gfx+2+254*13+9
PREDICTED: SIGSEGV at image_end+3297 (DF-1589 site)
od-acg-count-255: image_len=139 (guard page at image end)
od-acg-count-255: rc=0 (returned without fault)
MODE od-acg-count-255 DONE rc=0
----- exit=0 -----
===== [FIXED] MODE gfxclk-v1-count-255 =====
gfxclk-v1-count-255: rev0 ucNumEntries=255, 1 record -> get_gfxclk_voltage_dependency_table:620 walk entries[i]
PREDICTED: SIGSEGV at image_end+0 (read of entries[1])
gfxclk-v1-count-255: image_len=135 (guard page at image end)
gfxclk-v1-count-255: rc=0 (returned without fault)
  vdd_dep_on_sclk->count=1 (fw claims 255, image holds 1 -> clamped to image (fix works))
MODE gfxclk-v1-count-255 DONE rc=0
----- exit=0 -----
===== [FIXED] MODE socclk-count-255 =====
socclk-count-255: ucNumEntries=255 with 2 record(s) in image -> count-driven source copy loop reads past image
PREDICTED: SIGSEGV at image_end+0
socclk-count-255: image_len=136 (guard page at image end)
socclk-count-255: rc=0 (returned without fault)
  vdd_dep_on_socclk->count=2 (fw claims 255, image holds 2 -> clamped to image (fix works))
MODE socclk-count-255 DONE rc=0
----- exit=0 -----
===== [FIXED] MODE mclk-count-255 =====
mclk-count-255: ucNumEntries=255 with 2 record(s) in image -> count-driven source copy loop reads past image
PREDICTED: SIGSEGV at image_end+0
mclk-count-255: image_len=140 (guard page at image end)
mclk-count-255: rc=0 (returned without fault)
  vdd_dep_on_mclk->count=2 (fw claims 255, image holds 2 -> clamped to image (fix works))
MODE mclk-count-255 DONE rc=0
----- exit=0 -----
===== [FIXED] MODE mm-count-255 =====
mm-count-255: ucNumEntries=255 with 1 record(s) in image -> count-driven source copy loop reads past image
PREDICTED: SIGSEGV at image_end+0
mm-count-255: image_len=143 (guard page at image end)
mm-count-255: rc=0 (returned without fault)
  mm_dep_table->count=1 (fw claims 255, image holds 1 -> clamped to image (fix works))
MODE mm-count-255 DONE rc=0
----- exit=0 -----
===== [FIXED] MODE pixclk-count-255 =====
pixclk-count-255: ucNumEntries=255 with 2 record(s) in image -> count-driven source copy loop reads past image
PREDICTED: SIGSEGV at image_end+0
pixclk-count-255: image_len=136 (guard page at image end)
pixclk-count-255: rc=0 (returned without fault)
  vdd_dep_on_pixclk->count=2 (fw claims 255, image holds 2 -> clamped to image (fix works))
MODE pixclk-count-255 DONE rc=0
----- exit=0 -----
===== [FIXED] MODE powertune-v3-short =====
powertune-v3-short: rev=7 (V3 dispatch) with a 38-byte (V2-sized) table in image; V3 usBoostStartTemperature at +38
PREDICTED: SIGSEGV at image_end+0 (:488)
powertune-v3-short: image_len=162 (guard page at image end)
amdgpu: [powerplay] PowerTune table out of range!
amdgpu: [powerplay] init_powerplay_extended_tables failed
powertune-v3-short: rc=-22 (returned without fault)
MODE powertune-v3-short DONE rc=-22
----- exit=234 -----
===== [FIXED] MODE hardlimit-tail =====
hardlimit-tail: header claims 1 entry, no record bytes -> get_hard_limits:814 entries[0].ulSOCCLKLimit
PREDICTED: SIGSEGV at image_end+0
hardlimit-tail: image_len=126 (guard page at image end)
amdgpu: [powerplay] Hard limit table out of range!
amdgpu: [powerplay] init_powerplay_extended_tables failed
hardlimit-tail: rc=-1 (returned without fault)
MODE hardlimit-tail DONE rc=-1
----- exit=255 -----
===== [FIXED] MODE pcie-null-sclk =====
pcie-null-sclk: pcie table present, gfxclk offset 0 -> get_pcie_table:781 table_info->vdd_dep_on_sclk->count
PREDICTED: SIGSEGV at NULL (DF-1587)
pcie-null-sclk: image_len=132 (guard page at image end)
amdgpu: [powerplay] GFXCLK dependency table missing!
amdgpu: [powerplay] init_powerplay_extended_tables failed
pcie-null-sclk: rc=-22 (returned without fault)
MODE pcie-null-sclk DONE rc=-22
----- exit=234 -----
===== [FIXED] MODE dcefclk-pioneer-write =====
dcefclk-pioneer-write: dev 0x6863 rev 0, ucNumEntries=255 all in image, last ulClk<90000 -> pioneer path:
  alloc = 4 + NUM_DSPCLK_LEVELS(8)*28 = 228 bytes, copy loop runs ucNumEntries=255 (:740)
PREDICTED: SIGSEGV on first write past the 228-byte object (entries[8] at +232)
dcefclk-pioneer-write: image_len=1401 (guard page at image end)
dcefclk-pioneer-write: rc=0 (returned without fault)
MODE dcefclk-pioneer-write DONE rc=0
----- exit=0 -----
===== [FIXED] MODE dcefclk-pioneer-canary =====
dcefclk-pioneer-canary: dev 0x6863 rev 0, ucNumEntries=255 all in image, last ulClk<90000 -> pioneer path:
  alloc = 4 + NUM_DSPCLK_LEVELS(8)*28 = 228 bytes, copy loop runs ucNumEntries=255 (:740)
PREDICTED: no fault; canary shows ~6916 bytes attacker-controlled overwrite
dcefclk-pioneer-canary: image_len=1401 (guard page at image end)
dcefclk-pioneer-canary: rc=0 (returned without fault)
  canary: obj len=232 at 0x8004bdc00 -> changed=0 bytes past object, range [+0,+0] (intact)
  canary: obj len=228 at 0x8004bb800 -> changed=0 bytes past object, range [+0,+0] (intact)
  canary: obj len=36 at 0x8004b9400 -> changed=0 bytes past object, range [+0,+0] (intact)
  vdd_dep_on_dcefclk->count=8 (pioneer path stores 8 either way; the baseline copy loop still runs 255 and overwrites the 228-byte object, fixed loop runs 8)
MODE dcefclk-pioneer-canary DONE rc=0
----- exit=0 -----
===== [FIXED] MODE vddc-lookup-write =====
vddc-lookup-write: ucNumEntries=255, max_levels=8 -> alloc 4+8*10=84 bytes, loop copies 255 (:1036) DF-1586
PREDICTED: SIGSEGV on first OOB write (entries[8].us_vdd at obj+86, object len 84)
vddc-lookup-write: image_len=636 (guard page at image end)
vddc-lookup-write: rc=0 (returned without fault)
MODE vddc-lookup-write DONE rc=0
----- exit=0 -----
===== [FIXED] MODE vddc-lookup-canary =====
vddc-lookup-canary: ucNumEntries=255, max_levels=8 -> alloc 4+8*10=84 bytes, loop copies 255 (:1036) DF-1586
PREDICTED: no fault; canary shows strided 2-byte writes at +4+10i+2 for i=8..254, values == image bytes
vddc-lookup-canary: image_len=636 (guard page at image end)
vddc-lookup-canary: rc=0 (returned without fault)
  canary: obj len=232 at 0x8004bdc00 -> changed=0 bytes past object, range [+0,+0] (intact)
  canary: obj len=84 at 0x8004bb800 -> changed=0 bytes past object, range [+0,+0] (intact)
  canary intact: 0 OOB writes past the 84-byte object (fix clamps count to 8)
  vddc_lookup_table->count=8 (baseline overflows the 84-byte object with 247 more writes; fixed clamps loop to 8)
MODE vddc-lookup-canary DONE rc=0
----- exit=0 -----
===== [FIXED] MODE gfxclk-v2-leak =====
gfxclk-v2-leak: rev1 ucNumEntries=40, 2 records in image (last in-image acg=0, OOB acg byte=0x34), victim bytes after image end
PREDICTED baseline: no fault; entries[2..39] values byte-exact with victim bytes; od engineClock decided by the OOB ACG byte (0) -> 198000
PREDICTED fixed:    count clamped to 2; engineClock decided by in-image rec1 acg (1) -> 200000
gfxclk-v2-leak: rc=0 image_len=152
  od: entries[39].ucACGEnable at image+642 (image_len=152) -> OOB victim byte 0x34, in-image rec1 byte 0x00; engineClock=198000 (OOB-expect 200000, in-image-expect 198000) => decision bit == in-image byte
  vdd_dep_on_sclk->count=2 (image holds 2)
  V2-walk provenance: 0 OOB records byte-exact with the bytes past the image (0 mismatch) -> values surface to userland via powerplay sysfs
MODE gfxclk-v2-leak DONE rc=0
----- exit=0 -----
===== [FIXED] MODE socclk-leak-canary =====
socclk-leak-canary: ucNumEntries=40, 5 records in image, victim bytes after image end (DF-4247 leak-canary class)
socclk-leak-canary: rc=0 image_len=151
  vdd_dep_on_socclk->count=5 (image holds 5)
  count clamped to the 5 in-image records -> no OOB reads (fix works)
MODE socclk-leak-canary DONE rc=0
----- exit=0 -----
===== [FIXED] MODE result-clobber =====
result-clobber: vddc lookup fails (count=0 -> returns 1), vddmem/vddci succeed -> init_dpm_2_parameters:1103-1128 overwrites result
amdgpu: [powerplay] Invalid SOC_VDDD Lookup Table!
amdgpu: [powerplay] init_dpm_2_parameters failed
result-clobber: rc=1 vddc_lookup_table=0x0 vddmem=0x8004c06c0 vddci=0x8004c0690
  failure correctly propagated (fixed behavior)
MODE result-clobber DONE rc=0
----- exit=0 -----
===== [FIXED] MODE entry-offbyone =====
entry-offbyone: entry_index==ucNumEntries==2 passes the '<=' check (:1308) -> states[2].usClassification read at image_end+8 (DF-1588)
PREDICTED (baseline): SIGSEGV at image_end+8; (fixed: rc=-1)
amdgpu: [powerplay] Invalid PowerPlay Table State Array Entry.
entry-offbyone: rc=-1 cb_count=0
MODE entry-offbyone DONE rc=0
----- exit=0 -----