# DF-1149 — Heap OOB write in SMC UVD/VCE/ACP/SAMU level population (radeon ci_dpm.c)

**Status:** REPRODUCED at code level — **latent at runtime on this guest** (no AMD GPU).
**Severity (finding):** High · CWE-787 Out-of-bounds Write

## What the bug is
The radeon driver's `ci_populate_smc_{uvd,vce,acp,samu}_level`
(`sys/dev/drm/radeon/ci_dpm.c:2689/2732/2765/2797`) set each
`table->*LevelCount` directly from the VBIOS-derived
`*_clock_voltage_dependency_table.count` (unbounded `u8`) and loop writing
`table->*Level[count]` into fixed `[SMU7_MAX_LEVELS_*=8]` arrays
(`sys/dev/drm/radeon/smu7_discrete.h:327-330`, `smu7.h:45-48`). No clamp.
This is the **same bug class as DF-1142**; the radeon copy of `ci_dpm.c` was
simply not fixed alongside amdgpu.

## Why it does not trigger here
No AMD GPU on the QEMU/KVM guest (`0x1234:0x1111` std VGA); `radeon` is not
in `X86_64_GENERIC` (only in LINT64 as a test config). Latent on physical
Sea Islands HW with a malicious/reflashed VBIOS.

## What was validated
1. **Source trace** confirmed (see VERDICT.md `kernel_refs`).
2. **Baseline** `radeon.ko` (incl. `ci_dpm.o`) builds clean under `-Werror`.
3. **Fix** `fix.diff` applies (4 hunks) and patched `ci_dpm.o` rebuilds clean
   under `-Werror` (`ci_dpm.o`: 55424 -> 55456 bytes).

## Reproduce (compile-validation only)
```
scp this-folder/fix.diff root@guest:/root/df1149.diff
cd /usr/src && patch -p1 --forward < /root/df1149.diff
cd sys/dev/drm/radeon && rm -f ci_dpm.o && make ci_dpm.o   # -Werror clean
```

## Fix
`fix.diff` clamps each `*LevelCount` to its `SMU7_MAX_LEVELS_*` via
`min_t(u8, ...)` before the loop — same shape as the DF-1142 amdgpu fix;
matches the finding recommendation.