# DF-1141 — Heap OOB write in `ci_setup_default_dpm_tables` (amdgpu ci_dpm.c)

**Status:** REPRODUCED at code level — **latent at runtime on this guest** (no AMD GPU).
**Severity (finding):** High · CWE-787 Out-of-bounds Write

## What the bug is
`ci_setup_default_dpm_tables()` (`sys/dev/drm/amd/amdgpu/ci_dpm.c:3582`) copies
VBIOS-supplied PowerPlay dependency-table counts (a `u8`, up to 255, from
`amdgpu_parse_clk_voltage_dep_table` at `amdgpu_dpm.c:302`) into the fixed
`dpm_levels[MAX_REGULAR_DPM_NUMBER=8]` arrays (`ci_dpm.h:60,65`) with **no
clamp**. A crafted VBIOS with `ucNumEntries > 8` overflows sclk/mclk/vddc/
vddci/mvdd tables into adjacent `ci_power_info` fields.

## Why it does not trigger here
The QEMU/KVM guest has **no AMD GPU** (`pciconf` shows only `0x1234:0x1111`
QEMU std VGA), and `amdgpu` is **not** in `X86_64_GENERIC`. The path runs only
at DPM init on real Sea Islands (Bonaire/Hawaii) hardware with a malicious
VBIOS. This is a **latent** finding on the audit guest.

## What was validated
1. **Source trace** — the unbounded loops and the unbounded count source are
   confirmed (see VERDICT.md `kernel_refs`).
2. **Baseline compiles** — `amdgpu.ko` (incl. `ci_dpm.o`) builds clean from
   `/usr/src` under `-Werror`.
3. **Fix compiles** — `fix.diff` applies (3 hunks) and the patched `ci_dpm.o`
   rebuilds clean under `-Werror` (`ci_dpm.o`: 68080 -> 68176 bytes).

## Reproduce (compile-validation only — no runtime trigger on this guest)
```
# on the guest, as root, from the with-src snapshot:
scp this-folder/fix.diff root@guest:/root/df1141.diff
cd /usr/src && patch -p1 --forward < /root/df1141.diff
cd sys/dev/drm/amd/amdgpu && rm -f ci_dpm.o && make ci_dpm.o   # -Werror clean
```
Or just `./build.sh` after copying `fix.diff` to `/root/`.

## Fix
`fix.diff` clamps each of the five loops in `ci_setup_default_dpm_tables` to
`MAX_REGULAR_DPM_NUMBER` and clamps the trailing `.count` assignments —
matches the finding's recommendation.