{"finding_id":"DF-4885","status":"untested","attempts":0,"reproduced":0,"impact":"none","confidence":"certain","verdict":"Hardening only (no leak channel, no fault path): the guard is size < 0x49 but bios[0x49] is then read (one past a 0x49-byte buffer, reachable via a crafted VFCT ImageLength); separately size < tmp admits tmp==size and the 4-byte memcmp reads up to 4 past the end. Both reads are slab-interior on the DF allocator (cannot fault) and feed only a validity branch - never disclosed to userspace. Upstream-inherited. Tighten-both-guards fix.","exploit_chain":"none - comparison-only OOB reads","evidence":"findings/poc/DF-4885/ (this verdict)","kernel_refs":["sys/dev/drm/amd/amdgpu/amdgpu_bios.c:52","sys/dev/drm/amd/amdgpu/amdgpu_bios.c:62","sys/dev/drm/amd/amdgpu/amdgpu_bios.c:69","sys/dev/drm/amd/amdgpu/amdgpu_bios.c:74"],"guest_uname":"","code_hash":""}