# DF-1269 — kv_parse_power_table missing bounds checks on VBIOS indices (LATENT)

## Verdict
**NOT REPRODUCED on the audit guest (LATENT / HW-gated).** The bug is
**confirmed real by source-level trace** (`confidence=certain` in the DB); it
cannot fire here because there is no AMD APU/GPU, so the `kv_dpm.c` power-table
parse path is dead at runtime.

## Mechanism (confirmed in source)
`kv_parse_power_table` (`kv_dpm.c:~2710`) reads VBIOS-supplied indices without
bounds checks against `ucNumEntries`:
- **nonClockInfoIndex** (`kv_dpm.c:2745-2747`):
  `non_clock_array_index = power_state->v2.nonClockInfoIndex;` (u8 from VBIOS),
  then `&non_clock_info_array->nonClockInfo[non_clock_array_index]` — **no check**
  `non_clock_array_index < non_clock_info_array->ucNumEntries` → OOB read from
  the BIOS mapping.
- **vce_states clk_idx** (`kv_dpm.c:2780-2782`):
  `clock_array_index = adev->pm.dpm.vce_states[i].clk_idx;` (range 0..63),
  then `&clock_info_array->clockInfo[clock_array_index * ucEntrySize]` — **no
  check** vs `ucNumEntries`.
- The **sibling** clock-info path at `:2758` (`if (clock_array_index >=
  clock_info_array->ucNumEntries) continue;`) **does** check — proving these
  two were missed.

A crafted VBIOS → OOB read from the BIOS mapping → panic or leak into
sysfs-visible `rps` fields.

## Why it does not reproduce here
No AMD GPU on the guest (`pciconf -lv`); `kv_dpm` attaches only to AMD APUs.
Reaching the bug needs that hardware + a crafted VBIOS. **Valid hard blocker**.

## Exploit chain
N/A — OOB read (info leak / panic), HW-gated (latent). No write primitive.

## PoC changes
`trigger.c` is a documentation stub.

## Fix (`fix.diff`)
Add the two missing bounds checks, mirroring the existing `:2758` check:
- skip the state if `non_clock_array_index >= non_clock_info_array->ucNumEntries`
  (advance `power_state_offset` and `continue`);
- skip the vce state if `clock_array_index >= clock_info_array->ucNumEntries`.
Applies cleanly (`patch -p1` rc=0). Matches the finding proposal.

## Fix validation
`not_testable` — code path unreachable on audit guest; diff applies cleanly,
syntactically reviewed.