/*
 * DF-1271 trigger note — tonga VBIOS mm_dep_table->count heap overflow.
 *
 * Bug (sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c):
 *   tonga_populate_smc_uvd_level (:1307)  table->UvdLevelCount = (uint8_t)mm_table->count;
 *     for(count=0; count<UvdLevelCount; count++) table->UvdLevel[count]=...;  // sized [8]
 *   tonga_populate_smc_vce_level (:1367)  table->VceLevelCount ... VceLevel[8]
 *   tonga_populate_smc_acp_level (:1413)  table->AcpLevelCount ... AcpLevel[8]
 *   smu72.h: SMU72_MAX_LEVELS_UVD/VCE/ACP = 8
 *   smu72_discrete.h:270-272  UvdLevel[8]/VceLevel[8]/AcpLevel[8]
 *   mm_table->count comes from the VBIOS PowerPlay table ucNumEntries (u8 1-255;
 *   only a !=0 check at parse time, processpptables.c:391).  count > 8 -> writes
 *   overflow the level arrays into the adjacent smc_state_table fields and, far
 *   enough, into the tonga_smumgr power_tune_defaults pointer (dereferenced later).
 *
 * Reachability on the audit guest:
 *   tonga_smumgr.c is in the loadable amdgpu.ko (NOT in the base kernel).  The
 *   functions run during powerplay table population on an AMD Tonga GPU, driven
 *   by the VBIOS.  The QEMU guest has no AMD GPU (vgapci is virtio-class) and
 *   amdgpu.ko is not loaded.  Not triggerable here; latent on Tonga hardware
 *   with a crafted/buggy VBIOS PowerPlay table.
 *
 * Documentation/no-trigger PoC.  See VERDICT.md + fix.diff.
 */
#include <stdio.h>
int main(void) {
    printf("[DF-1271] tonga mm_dep_table->count -> UvdLevel/VceLevel/AcpLevel[8] overflow.\n"
           "[DF-1271] Sink in loadable amdgpu.ko (module-only); driven by VBIOS on AMD\n"
           "[DF-1271] Tonga hardware.  Not triggerable on this QEMU guest.\n"
           "[DF-1271] Bug confirmed in source; see VERDICT.md + fix.diff.\n");
    return 0;
}