# DF-1139 — radeon/si_dpm.c si_get_std_voltage_value count==0 OOB

## TL;DR
- **Status: REPRODUCED (source + harness).** When `cac_leakage_table` is
  allocated for `ucNumEntries==0`, `kzalloc(0)` returns `ZERO_SIZE_PTR`
  (non-NULL) and `count==0`. The pointer-only guard in
  `si_get_std_voltage_value` passes; the fallback reads
  `entries[(u32)0 - 1]` = `entries[0xFFFFFFFF]` — a ~16-32 GB OOB read
  that always page-faults.
- **Impact: panic / DoS** (offset is too large to ever land on a mapped
  page, so this is always a panic; no info leak achievable).

## Why no live trigger on this guest
Bug is in `radeon.ko`. The QEMU audit guest has no AMD GPU.

## Files
- `harness.c` — simulates the ZERO_SIZE_PTR allocation and traces the
  OOB address computation.
- `fix.diff` — augments the guard with `count > 0`.
- `run.log`, `env.txt`.

## Reproduce
```
./build.sh && ./run.sh
```
Expected: harness shows buggy guard passing with count==0 (computes a
~32 GB OOB address), fixed guard rejecting.

## Fix validation
`fix.diff` applied; `radeon.ko` rebuilt cleanly (2,029,288 bytes).