# DF-1272 — tonga VBIOS vdd_dep_on_sclk->count drives Sclk_voltageOffset overflow

## Verdict
**INCONCLUSIVE (hardware-gated latent bug, not triggerable on this guest).**
The overflow is **confirmed real by source tracing**; not reachable on the audit
QEMU guest because the sink lives in the loadable `amdgpu.ko` module and runs
only on AMD Tonga hardware (with clock-stretching enabled) driven by a
(crafted/buggy) VBIOS (absent). fix.diff authored and **validated to apply +
compile** (nativekernel `rc=0`, `-Werror`).

## Mechanism (source trace)
`tonga_populate_clock_stretcher_data_table`
(`sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c:1620`):
```c
uint8_t i;
struct phm_ppt_v1_clock_voltage_dependency_table *sclk_table =
        table_info->vdd_dep_on_sclk;
...
for (i = 0; i < sclk_table->count; i++) {
    ...
    smu_data->smc_state_table.Sclk_voltageOffset[i] = volt_offset;   /* [8] */
}
```
Array bound:
- `Sclk_voltageOffset[8]` (`smu72_discrete.h:344`). Immediately followed in the
  struct by `ClockStretcherDataTable` and `CKS_LOOKUPTable`, and downstream by
  the `DpmTable` tail / `tonga_smumgr.power_tune_defaults` pointer.

Count source:
- `sclk_table->count` = VBIOS `ucNumEntries` (u8, 1–255; only a `!= 0` check at
  parse, `processpptables.c`). With `count > 8`, `i >= 8` writes
  `Sclk_voltageOffset[8..]`, overflowing into `ClockStretcherDataTable`,
  `CKS_LOOKUPTable`, and — far enough — the `power_tune_defaults` pointer that is
  later dereferenced. The written value (`volt_offset`, a derived u8) is partly
  attacker/VBIOS-shaped.

Gating:
- The function is reached only when `PHM_PlatformCaps_ClockStretcher` is set in
  the platform caps (a VBIOS-controlled capability).

## Reachability on the audit guest
- `tonga_smumgr.c` is **module-only** (`amdgpu.ko`), not in the base kernel;
  `amdgpu.ko` not loaded.
- Runs only on AMD Tonga hardware whose VBIOS enables clock stretching. The
  guest has no AMD GPU. Not triggerable here.

## Exploit chain
None — not exercisable on this guest (module-only + no AMD Tonga HW + VBIOS
capability gate). The primitive is an OOB write of a derived byte past
`Sclk_voltageOffset[8]`; reachable only on real Tonga hardware with a malformed
VBIOS that enables clock stretching.

## PoC changes
Authored `tonga_sclk_voltage_offset_overflow.c` — documentation stub recording
the module-only / VBIOS-driven reachability finding.

## Fix validation
- `fix.diff` applies cleanly: `git apply --check -p1` ⇒ OK (1 hunk).
- Compiles: `make nativekernel` rebuilt `amdgpu.ko` ⇒ `NK_DONE rc=0`,
  `tonga_smumgr.c` built with `-Werror` (`fix_build.log`).
- Functional test: **not_testable** (no AMD Tonga HW).

## Recommended fix
Bound the loop by the array size:
`for (i = 0; i < sclk_table->count && i < sizeof(...Sclk_voltageOffset)/sizeof(...[0]); i++)`
(`= 8`). See `fix.diff`.