反编译UEFI BIOS代码中数组越界访问问题求助

我正在分析从UEFI BIOS .exe包提取的.efi文件，已完成目标代码的注释与重命名，但仍缺失部分参数。反编译代码显示encoderModel_X函数中存在对ADDR_ENCODE_PARAMS_X数组的索引10、11等超界访问，但内存映射显示该数组仅有8个元素，后续区域为PTR_TABLE_SUFFIX_X，想确认这类超界访问是否指向后续的PTR_TABLE_SUFFIX_X区域，寻求技术帮助。

反编译代码片段 #

isModelWhenZero = isModel_X_or_Y(MODEL_SERVICE_TAG_4);
if ((isModelWhenZero == 0xffff) ||
    (*(longlong *)(&ADDR_ENCODE_PARAMS_X + isModelWhenZero * 24) == 0)) {
    resultInfo = L'\x02';
}
else {
    initArrayMemoryZero((undefined8 *)INITIAL_DATA,16);
    initArrayMemoryZero(ENC_BLOCK_SERIAL_TAG,32);
    copyArrayContent(ENC_BLOCK_SERIAL_TAG,MODEL_SERIAL_7,size);
    charCodeAt(local_74,(ulonglong)MODEL_SERVICE_TAG_4,4);
    copyArrayContent((undefined8 *)((longlong)ENC_BLOCK_SERIAL_TAG + size),(undefined8 *)local_74 ,4);
    encoderModel_X(INITIAL_DATA,(longlong)ENC_BLOCK_SERIAL_TAG,rol,F2,F3,F4,F5,
                  *(uint **)(&ADDR_ENCODE_PARAMS_X + isModelWhenZero * 24));
    applySHA256ToCoded((byte *)INITIAL_DATA,16,(undefined8 *)FINAL_CODE_RESULT,local_78,(byte *)0x0,
                       0);
    calculateSuffix_8FC8(SUFFIX_TYPE_CHAR,SUFFIX_SIZE_?,FINAL_CODE_RESULT,MODEL_SERVICE_TAG_4);
    resultInfo = 0;
}

encoderModel_X函数内访问代码 #

A = A | *ADDR_ENCODE_PARAMS_X ;
B = B ^ ADDR_ENCODE_PARAMS_X [1];
C = C | ADDR_ENCODE_PARAMS_X [2] - p;
D = D ^ ADDR_ENCODE_PARAMS_X [3] + p;

A = A | ENCODE_PARAMS[4];
B = B ^ ENCODE_PARAMS[5];
C = C | ENCODE_PARAMS[6] - p;
D = D ^ ENCODE_PARAMS[7] + p;

if (ADDR_ENCODE_PARAMS_X [10] != 0) {
    j = ADDR_ENCODE_PARAMS_X [11];
}

内存映射信息 #

ADDR_ENCODE_PARAMS_X                         
        0000a9c8 00              ??         00h
        0000a9c9 00              ??         00h
        0000a9ca 00              ??         00h
        0000a9cb 00              ??         00h
        0000a9cc 00              ??         00h
        0000a9cd 00              ??         00h
        0000a9ce 00              ??         00h
        0000a9cf 00              ??         00h

PTR_TABLE_SUFFIX_X                       
        0000a9d0 80  a2  00      ds *       s_0Q2drGk99WLJ1...

内容的提问来源于stack exchange，提问作者cruz190