Summary

Fire animation fade loop reads buf[(x+1)+((y+1)*X_SIZE)] without explicit horizontal wrap. At loop final iteration (x=319 y=199) index evaluates to 64320 -- exactly one byte past end of static buffer buf[X_SIZE*(Y_SIZE+1)]=buf[64320] valid indices 0..64319. Deterministic 1-byte OOB read of adjacent kernel BSS on every animation frame. buf declared buf[64320] at fire_saver.c:56 fade loop at 92-101 iterates y=0..199 x=0..319. At x=319 (x+1)=320+(y+1)*320=(y+2)*320 at y=199 row 201 does NOT exist buffer only has 201 rows 0..200 index 320+200*320=64320 one past end. OOB byte is first byte of next static BSS object (vid pointer or padding). Security impact negligible: READ not write; OOB byte summed with 3 in-bounds bytes /4 conditionally decremented stored as pixel blitted to VRAM original byte unrecoverable; even if recovered is LSB of fixed VGA aperture addr 0xA0000 or zero padding not sensitive; adjacent mapped BSS same module cannot page-fault. Reported Info/defense-in-depth real UB KASAN/KMSAN would flag.