reachable enum values: 11 transmitter, 9 channel, 7 hpd
OOB: 4/11 transmitter, 3/9 channel, 1/7 hpd (= 8/27 reachable values)

example craftable link: TRAVIS_CRT encoder + DDC_VGA line + connector without HPD -> idx 7 / 6 / 7 (all OOB)

CONST-TABLE OOB READ CONFIRMED (model): dce100_resource.c:573-575 forms &link_enc_regs[tx], &link_enc_aux_regs[ch-1], &link_enc_hpd_regs[hpd] with unvalidated VBIOS-derived indexes — garbage becomes the encoder's MMIO register bases.
RC=0