# DF-1182 — VERDICT

**Status:** NOT REPRODUCED (HW-gated; bug confirmed in source)
**Impact:** none (cannot trigger on this guest)
**Confidence:** certain (line-by-line source trace)
**Class:** heap OOB read (CWE-125) — latent

## Mechanism (cited)

`vega10_hwmgr.c:2970-3063` — `vega10_get_pp_table_entry_callback_func`
is called by `vega10_get_pp_table_entry` (line 3066) for each VBIOS
power state.  It reads six `uint8_t` clock indices from the
`ATOM_Vega10_State` record and indexes the dep tables without any
bounds check:

```c
// lines 3042-3062 (six OOB-read sites)
performance_level->soc_clock = socclk_dep_table->entries[state_entry->ucSocClockIndexLow].ulClk;
performance_level->gfx_clock = gfxclk_dep_table->entries[state_entry->ucGfxClockIndexLow].ulClk;
performance_level->mem_clock = mclk_dep_table->entries[state_entry->ucMemClockIndexLow].ulMemClk;
performance_level->soc_clock = socclk_dep_table->entries[state_entry->ucSocClockIndexHigh].ulClk;
performance_level->gfx_clock = gfxclk_dep_table->entries[state_entry->ucGfxClockIndexHigh].ulClk;
performance_level->mem_clock = mclk_dep_table->entries[state_entry->ucMemClockIndexHigh].ulMemClk;
```

The dep tables (`socclk_dep_table`, `gfxclk_dep_table`, `mclk_dep_table`)
are pointers into the VBIOS PowerPlay table at offsets chosen by the
firmware; their `ucNumEntries` governs the valid range.  Same class as
DF-1168 (smu7).

## Why it cannot be reproduced on this guest

* No AMD GPU on the PCI bus.
* `amdgpu`/`powerplay` are not in `X86_64_GENERIC`; module present at
  `/boot/kernel/amdgpu.ko` but never attaches.
* The PowerPlay table is parsed from device firmware at attach time, so
  even with hardware the trigger requires a malicious VBIOS (`PR:H`).

**Latent / hardware-gated** bug; confirmed real by source trace,
unreachable on the audit guest.  `harness.c` transcribes the indexing
logic into userspace; it builds, runs, and prints which indices would
OOB-read, but produces no kernel effect.

## Fix
`fix.diff` adds a single early bounds check covering all six
`uc*ClockIndex*` fields, returning `-EINVAL` if any is out of range.
Validated as **applies + compiles** only — `fix_status: not_testable`
(the bug path cannot be exercised without AMD hardware).