# DF-1255 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** speculative

## Finding
vega20_setup_single_dpm_table writes dpm_levels[16] without bounding SMU-returned num_of_levels

## Source Location
sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:466-525

## Verdict
Source-confirmed: vega20_setup_single_dpm_table writes dpm_levels[16] without bounding S. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
vega20_setup_single_dpm_table at vega20_hwmgr.c:517-525: dpm_table->count=num_of_levels, for(i=0;i<num_of_levels;i++) dpm_table->dpm_levels[i].value=clk. dpm_levels[MAX_REGULAR_DPM_NUMBER=16]. vega20_get_number_of_dpm_level only asserts >0, not <=16. SMU firmware returning >16 -> OOB write into adjacent dpm_tables/vega20_hwmgr struct. find_highest_dpm_level correctly asserts <=16 (developer knew bound but not on producer). SMU firmware bug/ECC/emulation. Fix: assert num_of_levels<=MAX_REGULAR_DP