# DF-1136 — si_get_svi2_voltage_table VBIOS count overflow past entries[32]

## Verdict
**CONFIRMED (source-trace + harness) — INCONCLUSIVE on-guest (HW-gated).** Real bug;
not triggerable on the QEMU guest (no AMD Southern Islands GPU; radeon not in GENERIC).

## Bug (one line)
`si_get_svi2_voltage_table()` sets `count` from the VBIOS-sourced dependency table and
loops `for (i=0;i<count;i++) entries[i] = ...` over a fixed `entries[MAX_VOLTAGE_ENTRIES=32]`
with no clamp; the two SVI2 call sites skip the trim that the GPIO path applies.

## Mechanism (path:line)
- `si_dpm.c:3951` — `voltage_table->count = voltage_dependency_table->count;`
  (count sourced from VBIOS power tables, u8 0..255 upstream, stored in a u32 field;
  unbounded here).
- `si_dpm.c:3952-3955` — `for (i=0;i<count;i++) entries[i].value=...; entries[i].smio_low=0;`
- `radeon_mode.h:671,684` — `MAX_VOLTAGE_ENTRIES = 32`; `entries[32]` fixed.
- `count > 32` => writes past `entries[32]` into the following fields of
  `struct evergreen_power_info` (the table is embedded there) — cac_weights, powertune
  pointers — corrupting state used by `si_dpm_enable`.
- `si_dpm.c:3977-3982` (vddc) and `si_dpm.c:3998-4004` (vddci) call
  `si_get_svi2_voltage_table()` with **no trim**, unlike the GPIO path
  (`si_dpm.c:3973-3976`, `3993-3996`) which calls `si_trim_voltage_table_to_fit_state_table`.

## Trigger / threat model
A malicious/corrupt VBIOS advertising SVI2 voltage control with `count > 32`
(reflash / KVM GPU passthrough / emulated radeon). Writes corrupt adjacent struct
fields -> corrupted pointers dereferenced during DPM enable -> panic or (no SMEP/SMAP)
potential code-exec. CVSS AC:H/PR:L.

## Reproduction on the audit guest
Not possible — no AMD GPU; radeon not in GENERIC. `harness.c` replicates the loop with
VBIOS-style counts (8..255) and shows count>32 writes past entries[32], then the fix
(clamp to 32) yields 0 OOB.

## Build / run
```
./build.sh && ./run.sh
```
Expected: `DF-1136: CONFIRMED heap OOB write past entries[32] (VBIOS count unbounded)`
then `DF-1136 FIX: VALIDATED - clamp prevents all overflows past entries[32]`.

## Fix
`fix.diff` clamps `voltage_table->count` to `MAX_VOLTAGE_ENTRIES` (matching the GPIO
path's trim intent). Applies cleanly; compiles in the radeon module build (`si_dpm.o`, rc=0).