# DF-1166 — PoC evidence pack

**Heap overflow: unvalidated VBIOS dependency-table count overflows `dpm_levels[8]` (amdgpu powerplay `sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:691-800`).**

`smu7_setup_dpm_tables_v0` (5 loops) and `_v1` (2 loops) copy the PP/VBIOS
dependency-table count (u8 up to 255) entries into `dpm_levels[MAX_REGULAR_DPM_NUMBER=8]`
with no upper bound. A crafted PP table (`count>8`) overflows each table into
the next and past `smu7_dpm_table` into the heap-allocated `smu7_hwmgr`. Same
class as DF-1141/DF-1150.

## Status
Source-confirmed + harness. **Latent at runtime on this guest**: amdgpu is NOT
in `X86_64_GENERIC`, and the guest has no AMD GPU.

## Reproduce
```
./build.sh          # cc -O2 -Wall -o harness harness.c   (unprivileged maxx)
./run.sh            # prints v0/v1 OOB write counts + fix check
```
Expected (harness): `v0 OOB writes = 1235 ; v1 OOB writes = 494 ; total = 1729`;
fix → 0.

## Fix
`fix.diff` clamps all 7 loops to `MAX_REGULAR_DPM_NUMBER` (and clamps the 3 v0
`.count` assignments). Validated: applies + compiles clean (incremental
`amdgpu.ko` build, `smu7_hwmgr.o`, `-Werror`). See `VERDICT.md`.