{
  "finding_id": "DF-4863",
  "title": "amdgpu_cgs_get_firmware_info indexes adev->firmware.ucode[fw_type_convert(type)] without a bound: default return == array size -> one-past-end element whose .fw aliases firmware.fw_buf (type-confused deref if ever reached)",
  "verdict": "reproduced",
  "impact": "none",
  "confidence": "certain",
  "reproduce": {
    "build": "sh build.sh  (same harness binary as DF-4862)",
    "run": "sh run.sh   (this finding's trigger is scenario [4])",
    "expected": "'&firmware.ucode[MAXIMUM].fw ... == &firmware.fw_buf ... : ALIAS CONFIRMED' and, with fw_buf non-NULL, 'cgs_get_firmware_info(CGS_UCODE_ID_GMCON_RENG) = 0' with garbage image_size propagated; patched twin: '-22 (one-past-end index rejected - FIX VALIDATED)'"
  },
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/amdgpu_cgs.c:214-215",
    "sys/dev/drm/amd/amdgpu/amdgpu_cgs.c:111-156",
    "sys/dev/drm/amd/amdgpu/amdgpu_ucode.h:252-268",
    "sys/dev/drm/amd/amdgpu/amdgpu_ucode.h:187-210",
    "sys/dev/drm/amd/include/cgs_common.h:46-63",
    "sys/sys/firmware.h:51-56"
  ],
  "artifacts": [
    "cgs_mec_jt_oob.c", "cgs_mec_jt_oob_patched.c", "build.sh", "build.log",
    "run.log", "run.2.log", "run.3.log", "env.txt", "fix.diff",
    "README.md", "VERDICT.md", "manifest.json", "verdict.json"
  ]
}