QEMU VGA: heap out-of-bounds write

The public finding

What was found.

A bounds check in the VGA renderer compares text-mode characters against graphics-mode pixels, so the resize is skipped: 960 bytes of guest-controlled palette past a 96-byte heap buffer, on every refresh, on a default machine.