Summary

instance = chan->rec.i2c_id & 0xf can produce indices 0..15 but aux_offset[] lookup table has only 6 entries (0..5). If BIOS AtomBIOS GPIO table supplies i2c_id whose low nibble is [6..15] every MMIO access indexed by aux_offset[instance] reads past end of static array and adds garbage to register base offset producing reads/writes to unintended MMIO addresses. chan->rec.i2c_id set directly from firmware at radeon_atombios.c:111 (i2c.i2c_id=gpio->sucI2cId.ucAccess) no validation of low nibble range. No upstream guarantee quirky/malformed BIOS cannot supply such value (radeon_lookup_i2c_gpio_quirks handles specific known-bad IDs not general range check). Effect: OOB read of .rodata past aux_offset[] bogus MMIO offset reads/writes to wrong GPU registers causing GPU hang/corrupted display/kernel panic on MMIO fault. Requires buggy VBIOS or attacker who can flash malicious VBIOS privileged. Defensive-coding gap inconsistent with rest of driver using ARRAY_SIZE() bounds checks.