=== baseline (verbatim kernel function): count=16, 2 distinct clocks ===
record size = 28 bytes, MAX entries = 8
[1] smu7_setup_dpm_tables_v1 dedup: 16 VBIOS entries -> 2 distinct dpm_levels (array holds 8) -> IN BOUNDS (DF-1166 site does NOT fire for this input)
[2] odn copy wrote dep->count=16 records into entries[8]
    OOB bytes past entries[7] : 224
    ...of which past end of backend-like object (2148 bytes): 0
    vdd_dependency_on_mclk.count now = 102500 (was 0)
    odn_mclk_min_limit now = 0x00000000 (was 0)
    min_vddc now = 0x00000000, max_vddc now = 0x00000000 (were 0)
    canary words after odn_dpm_table smashed: 0/64
OOB-WRITE CONFIRMED: smu_get_voltage_dependency_table_ppt_v1 wrote 224 attacker-controlled bytes out of bounds (vdd_dependency_on_mclk and/or later members of struct smu7_hwmgr corrupted)

=== baseline worst case: count=255 ===
record size = 28 bytes, MAX entries = 8
[1] smu7_setup_dpm_tables_v1 dedup: 255 VBIOS entries -> 2 distinct dpm_levels (array holds 8) -> IN BOUNDS (DF-1166 site does NOT fire for this input)
[2] odn copy wrote dep->count=255 records into entries[8]
    OOB bytes past entries[7] : 6916
    ...of which past end of backend-like object (2148 bytes): 6420
    vdd_dependency_on_mclk.count now = 100000 (was 0)
    odn_mclk_min_limit now = 0x00000010 (was 0)
    min_vddc now = 0x03941110, max_vddc now = 0x03f803c6 (were 0)
    canary words after odn_dpm_table smashed: 55/64
OOB-WRITE CONFIRMED: smu_get_voltage_dependency_table_ppt_v1 wrote 6916 attacker-controlled bytes out of bounds (vdd_dependency_on_mclk and/or later members of struct smu7_hwmgr corrupted)

=== baseline control: count=8 (in bounds) ===
record size = 28 bytes, MAX entries = 8
[1] smu7_setup_dpm_tables_v1 dedup: 8 VBIOS entries -> 2 distinct dpm_levels (array holds 8) -> IN BOUNDS (DF-1166 site does NOT fire for this input)
[2] odn copy wrote dep->count=8 records into entries[8]
    vdd_dependency_on_mclk.count now = 0 (was 0)
    odn_mclk_min_limit now = 0x00000000 (was 0)
    min_vddc now = 0x00000000, max_vddc now = 0x00000000 (were 0)
    canary words after odn_dpm_table smashed: 0/64
in-bounds (count <= 8): no overflow, as expected

=== patched twin: count=16 ===
[patched] dep->count=16 -> stored count = 8 (clamped to MAX_REGULAR_DPM_NUMBER)
[patched] vdd_dependency_on_mclk.count still = 0
[patched] canary words smashed: 0/64
FIX VALIDATED: no out-of-bounds writes with clamped copy

=== patched twin: count=255 ===
[patched] dep->count=255 -> stored count = 8 (clamped to MAX_REGULAR_DPM_NUMBER)
[patched] vdd_dependency_on_mclk.count still = 0
[patched] canary words smashed: 0/64
FIX VALIDATED: no out-of-bounds writes with clamped copy