{
 "finding_id": "DF-4524",
 "poc_id": "DF-4524",
 "status": "untested",
 "reproduced": 0,
 "impact": "Firmware writes to the last 256 bytes of the instance-1 DATA window land past vcpu_bo into the adjacent VRAM object (speculative - fw-defined; arithmetic overrun certain)",
 "confidence": "speculative",
 "attempts": 0,
 "guest_uname": null,
 "code_hash": null,
 "exploit_chain": [],
 "evidence": "bo sized FW+2*(STACK+DATA) but mc_resume lays regions out after a 256-byte head offset - instance-1 DATA ends exactly 256 bytes past the bo. Add-the-offset-to-the-size fix.",
 "kernel_refs": [
  "sys/dev/drm/amd/amdgpu/vce_v3_0.c:430",
  "sys/dev/drm/amd/amdgpu/vce_v3_0.c:552",
  "sys/dev/drm/amd/amdgpu/vce_v3_0.c:567",
  "sys/dev/drm/amd/amdgpu/vce_v3_0.c:574"
 ],
 "verdict": "not_run: no Fiji/Polaris/CZ hardware on guest; upstream-inherited, VRAM-only",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "not_testable: no AMD GPU on guest",
 "fix_evidence": "fix in finding markdown"
}