# DF-1142 — Heap OOB write in SMC UVD/VCE/ACP/SAMU level population (amdgpu ci_dpm.c)

**Status:** REPRODUCED at code level — **latent at runtime on this guest** (no AMD GPU).
**Severity (finding):** High · CWE-787 Out-of-bounds Write

## What the bug is
Four SMC level-population functions (`ci_populate_smc_{uvd,vce,acp,samu}_level`,
`sys/dev/drm/amd/amdgpu/ci_dpm.c:2791/2834/2867/2899`) set each
`table->*LevelCount` directly from the VBIOS-derived
`*_clock_voltage_dependency_table.count` (a `u8`, up to 255, parsed unbounded
at `amdgpu_dpm.c:302`) and then loop `for(count=0; count<*LevelCount; count++)`
writing `table->*Level[count]`. The destination arrays are fixed at 8
(`SMU7_MAX_LEVELS_UVD/VCE/ACP/SAMU = 8`, `smu7.h:45-48`;
`SMU7_Discrete_DpmTable` at `smu7_discrete.h:314-331`). No clamp. A crafted
VBIOS with `count > 8` overflows each Level array into the next and into SMU
state fields. (Voltage tables *are* clamped by `ci_trim_voltage_table_to_fit_state_table`;
these are not.)

## Why it does not trigger here
No AMD GPU on the QEMU/KVM guest (`0x1234:0x1111` std VGA); `amdgpu` not in
`X86_64_GENERIC`. Latent on physical Sea Islands HW.

## What was validated
1. **Source trace** confirmed (see VERDICT.md `kernel_refs`).
2. **Baseline** `amdgpu.ko` (incl. `ci_dpm.o`) builds clean under `-Werror`.
3. **Fix** `fix.diff` applies (4 hunks) and patched `ci_dpm.o` rebuilds clean
   under `-Werror` (`ci_dpm.o`: 68080 -> 68112 bytes).

## Reproduce (compile-validation only)
```
scp this-folder/fix.diff root@guest:/root/df1142.diff
cd /usr/src && patch -p1 --forward < /root/df1142.diff
cd sys/dev/drm/amd/amdgpu && rm -f ci_dpm.o && make ci_dpm.o   # -Werror clean
```

## Fix
`fix.diff` clamps each `*LevelCount` to its `SMU7_MAX_LEVELS_*` via
`min_t(u8, ...)` before the loop — matches the finding recommendation.