# DF-1182 — vega10 state-record clock indices OOB read

## Bug (confirmed in source)
`sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:3042-3062` (inside
`vega10_get_pp_table_entry_callback_func`):

```c
performance_level->soc_clock = socclk_dep_table->entries
        [state_entry->ucSocClockIndexLow].ulClk;
performance_level->gfx_clock = gfxclk_dep_table->entries
        [state_entry->ucGfxClockIndexLow].ulClk;
performance_level->mem_clock = mclk_dep_table->entries
        [state_entry->ucMemClockIndexLow].ulMemClk;
...
performance_level->soc_clock = socclk_dep_table->entries
            [state_entry->ucSocClockIndexHigh].ulClk;
if (gfxclk_dep_table->ucRevId == 0) {
    performance_level->gfx_clock = gfxclk_dep_table->entries
        [state_entry->ucGfxClockIndexHigh].ulClk;
} else if (gfxclk_dep_table->ucRevId == 1) {
    patom_record_V2 = (ATOM_Vega10_GFXCLK_Dependency_Record_V2 *)gfxclk_dep_table->entries;
    performance_level->gfx_clock = patom_record_V2[state_entry->ucGfxClockIndexHigh].ulClk;
}
performance_level->mem_clock = mclk_dep_table->entries
        [state_entry->ucMemClockIndexHigh].ulMemClk;
```

The `uc*ClockIndexLow/High` fields are `uint8_t` (0-255) read from the
VBIOS state record `ATOM_Vega10_State`. They index into the dep tables
without **any** check against the table's `ucNumEntries`.  Same class as
DF-1168 (smu7).

Allocation sizing (in `vega10_processpptables.c`): each dep table is
`kzalloc(sizeof(uint32_t) + sizeof(record) * ucNumEntries, ...)`.  With
`ucNumEntries = 2` and `ucMemClockIndexHigh = 99`, the kernel reads
`99 * sizeof(record)` (~800 bytes) past the 2-entry allocation.  Read
values become the power-state clocks surfaced via sysfs.

## Trigger model
- Requires `amdgpu` powerplay attached to a real Vega10 GPU.
- CVSS `AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H` — analyst's `PR:L`
  assumes an unprivileged user can supply a crafted PowerPlay table;
  in this code the table comes from device firmware at attach time so
  `PR:H` is the realistic bar.

## On this guest
Unreachable — no AMD GPU; amdgpu/powerplay never attaches.  `harness.c`
transcribes the indexing logic into userspace; it builds and runs,
printing which indices would OOB-read, but produces no kernel effect.

## Reproduce
```
ssh dfbsd-maxx "cd poc/DF-1182 && ./build.sh && ./run.sh"
```

## Recommended fix
Validate each of the six `uc*ClockIndex*` fields against the matching
`dep_table->ucNumEntries` before any dereference.  Full patch in
`fix.diff`. **Matches** the finding proposal.