Looking at envytools' nvbios decode, given ramcfg=1, the first entry of the
timing mapping table (0x718f) has a value of 0xf at index 1, offset 0. This is
taken as index into the timing table (0x733c); however, the timing table only
defines 12 entries, and only six of them are nonzero.

If I simply skip entry 0, reclocking works fine. Maybe that's what 0x0f
indicates?