# DF-1128 — amdgpu/si_dpm.c zero performance_level_count OOB read

## TL;DR
- **Status: REPRODUCED (source + harness).** Primitive is an OOB read of
  `state->performance_levels[count-1]` when `performance_level_count == 0`,
  confirmed by source trace + a userspace math harness that mirrors the
  kernel code.
- **Impact: leak / panic** (read primitive; not write-capable). The same
  pattern is reachable from sysfs via `si_dpm_get_sclk`/`si_dpm_get_mclk`
  which can leak the OOB-read value to userspace.
- **Caveat on the finding summary:** the `state_size` underflow half of the
  summary is **incorrect** — with the real struct layout it evaluates to
  `4`, not `~SIZE_MAX`. See VERDICT.md §"Finding-summary accuracy note".

## Why no live trigger on this guest
The bug is in `amdgpu.ko` (AMD Southern Islands DPM). The QEMU audit guest
has **no AMD GPU** (`pciconf -l` shows no ATI/AMD display device), so
`amdgpu.ko` is never `kldload`ed at boot. The trigger requires SI-class
hardware plus a crafted VBIOS whose `ATOM_PPLIB` power state has
`ucNumDPMLevels==0` (or all `clockInfoIndex` values out of range).

## Files
- `harness.c` — userspace logic harness mirroring `si_convert_power_state_to_smc`
  and the sclk/mclk getters. Demonstrates the OOB read primitive.
- `fix.diff` — git-apply-able unified diff against
  `sys/dev/drm/amd/amdgpu/si_dpm.c`. Rejects `count==0` in
  `si_convert_power_state_to_smc`, `si_upload_sw_state`, and the sclk/mclk getters.
- `run.log` — full output of the harness run.
- `env.txt` — guest environment.

## Reproduce
```
./build.sh && ./run.sh
```
Expected: harness prints the OOB read of `performance_levels[-1]` (returns
`0xcccccccc` from the simulated pre-object backing buffer), confirms the
finding's `state_size` underflow claim is wrong (real value is 4), and
demonstrates that the same `count-1` pattern is used by the sysfs-readable
`si_dpm_get_sclk`/`si_dpm_get_mclk`.

## Fix validation
The `fix.diff` was applied to the in-guest `/usr/src` tree and `amdgpu.ko`
was rebuilt with `make` from `/usr/src/sys/dev/drm/amd`. The full module
linked successfully (3.74 MB `amdgpu.ko`). See VERDICT.md for the build log
excerpt.