# DF-1183 — VERDICT

**Status:** NOT REPRODUCED (HW-gated; bug confirmed in source)
**Impact:** none (cannot trigger on this guest)
**Confidence:** certain (line-by-line source trace; finding markdown said
`likely`, I confirm `certain` — the indexing is unconditional, no guard
upstream)
**Class:** heap OOB read (CWE-125) — latent

## Mechanism (cited)

`vega10_hwmgr.c:3444-3453`:

```c
static int vega10_get_soc_index_for_max_uclk(struct pp_hwmgr *hwmgr)
{
    struct phm_ppt_v1_clock_voltage_dependency_table *vdd_dep_table_on_mclk;
    struct phm_ppt_v2_information *table_info =
            (struct phm_ppt_v2_information *)(hwmgr->pptable);

    vdd_dep_table_on_mclk  = table_info->vdd_dep_on_mclk;

    return vdd_dep_table_on_mclk->entries[NUM_UCLK_DPM_LEVELS - 1].vddInd + 1;
}
```

`NUM_UCLK_DPM_LEVELS == 4` (`smu9_driver_if.h:41`). The function
unconditionally dereferences `entries[3]` regardless of how many entries
the table actually holds.  The table is sized from the VBIOS-supplied
`ucNumEntries` (`vega10_processpptables.c:565-569`):

```c
table_size = sizeof(uint32_t) +
    sizeof(phm_ppt_v1_clock_voltage_dependency_record) * mclk_dep_table->ucNumEntries;
mclk_table = kzalloc(table_size, GFP_KERNEL);
```

If `ucNumEntries < 4`, the hardcoded `entries[3]` reads past the
allocation.  The returned value is then sent to the SMC firmware as a
`PPSMC_MSG_SetSoftMinSocclkByIndex` parameter at `vega10_hwmgr.c:3478`,
so corrupted heap bytes also reach the GPU's microcontroller.

## Why it cannot be reproduced on this guest

* No AMD GPU on the PCI bus; `amdgpu`/`powerplay` not in GENERIC.
* The MCLK table is parsed from device firmware at attach time, so even
  with hardware the trigger requires a malicious VBIOS (`PR:H`).

**Latent / hardware-gated** bug; confirmed real by source trace,
unreachable on the audit guest.  `harness.c` transcribes the function
into userspace, runs both buggy and fixed versions, and prints the
result; no kernel effect.

## Fix
`fix.diff` validates `vdd_dep_on_mclk->count >= NUM_UCLK_DPM_LEVELS`
(and `!= NULL`) before indexing `entries[3]`. Validated as **applies +
compiles** only — `fix_status: not_testable`.