BUILD_DF4495_OK
DF-4495 model: dce100_link_encoder_create (dce100_resource.c:573-575) const-table index domains

[link_enc_regs[7]]  indexed by transmitter (:573)
  transmitter=UNKNOWN     idx= -1  OOB READ
  transmitter=UNIPHY_A    idx=  0  ok
  transmitter=UNIPHY_B    idx=  1  ok
  transmitter=UNIPHY_C    idx=  2  ok
  transmitter=UNIPHY_D    idx=  3  ok
  transmitter=UNIPHY_E    idx=  4  ok
  transmitter=UNIPHY_F    idx=  5  ok
  transmitter=NUTMEG_CRT  idx=  6  ok
  transmitter=TRAVIS_CRT  idx=  7  OOB READ
  transmitter=TRAVIS_LCD  idx=  8  OOB READ
  transmitter=UNIPHY_G    idx=  9  OOB READ

[link_enc_aux_regs[6]]  indexed by channel-1 (:574)
  channel=0              idx= -1  OOB READ
  channel=1              idx=  0  ok
  channel=2              idx=  1  ok
  channel=3              idx=  2  ok
  channel=4              idx=  3  ok
  channel=5              idx=  4  ok
  channel=6              idx=  5  ok
  channel=7              idx=  6  OOB READ
  channel=8              idx=  7  OOB READ

[link_enc_hpd_regs[6]]  indexed by hpd_source (:575)
  hpd_source=0         idx=  0  ok
  hpd_source=1         idx=  1  ok
  hpd_source=2         idx=  2  ok
  hpd_source=3         idx=  3  ok
  hpd_source=4         idx=  4  ok
  hpd_source=5         idx=  5  ok
  hpd_source=7         idx=  7  OOB READ

reachable enum values: 11 transmitter, 9 channel, 7 hpd
OOB: 4/11 transmitter, 3/9 channel, 1/7 hpd (= 8/27 reachable values)

example craftable link: TRAVIS_CRT encoder + DDC_VGA line + connector without HPD -> idx 7 / 6 / 7 (all OOB)

CONST-TABLE OOB READ CONFIRMED (model): dce100_resource.c:573-575 forms &link_enc_regs[tx], &link_enc_aux_regs[ch-1], &link_enc_hpd_regs[hpd] with unvalidated VBIOS-derived indexes — garbage becomes the encoder's MMIO register bases.
RC=0