# DF-1181 — vega10 VBIOS vddInd/vddciInd/mvddInd OOB read

## Bug (confirmed in source)
`sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c` — three call sites read
the per-entry `vddInd` / `vddciInd` / `mvddInd` fields as `uint8_t`
(0-255 range, supplied by the VBIOS) and use them to index into
fixed-size voltage lookup tables with **no bounds check** against the
table's `count` or its `max_levels` allocation:

* `vega10_patch_voltage_dependency_tables_with_lookup_table()`
  lines 659, 666, 672, 675, 678 — five index sites in one function.
* `vega10_populate_single_display_type()` lines 1856-1857.
* `vega10_get_clock_by_type_with_voltage()` lines 4248-4249.

Allocation (in `sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c`):

```c
// get_vddc_lookup_table() at lines 1026-1034
table_size = sizeof(uint32_t) + sizeof(phm_ppt_v1_voltage_lookup_record) * max_levels;
table = kzalloc(table_size, GFP_KERNEL);
table->count = vddc_lookup_pp_tables->ucNumEntries;   // from VBIOS u8

// callers (lines 1108-1127) pass:
//   vddc_lookup_table   max_levels = 8
//   vddmem_lookup_table max_levels = 4
//   vddci_lookup_table  max_levels = 4
```

A malicious VBIOS that supplies `vddciInd = 100` therefore indexes
`vddci_lookup_table->entries[100]`, reading
`100 * sizeof(phm_ppt_v1_voltage_lookup_record)` (= 100 × 10 = 1000 bytes)
past the 4-entry (40-byte) allocation. Read values (`us_vdd`) propagate
into the SMC firmware and into the sysfs power-state tables — an info
leak of adjacent kernel heap, plus corrupted power-management state.

## Trigger model
- Requires `amdgpu` attached to a real AMD Vega10 GPU (powerplay hwmgr
  init path).  Not present on this guest.
- CVSS `AV:L/AC:L/PR:L/UI:N/S:U:C:H/I:N/A:H` — the analyst's `PR:L`
  assumes an unprivileged user could supply a crafted VBIOS / PowerPlay
  table via sysfs; on this code the table is parsed from the device's
  own firmware at attach time, so in practice the trigger is `PR:H`
  (root to flash malicious firmware).  The bug class is real either way.

## On this guest
Unreachable — no AMD GPU; `amdgpu.ko` is present but never attaches.
`harness.c` is a userspace transcription of the indexing logic; it
builds, runs, and prints which indices would OOB-read, but produces no
kernel effect.

## Reproduce
```
ssh dfbsd-maxx "cd poc/DF-1181 && ./build.sh && ./run.sh"
```

## Recommended fix
Bounds-check every `vddInd` / `vddciInd` / `mvddInd` / `vddcInd` against
the corresponding `*_lookup_table->count` before indexing; return
`-EINVAL` (or `-1` for the void-return-styled helpers) on violation.
Full patch in `fix.diff`. **Matches** the finding proposal.