# DF-1275 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
VDDCI GPIO-control path overflows SmioTable1.Pattern[4] when vddci count>4

## Source Location
sys/dev/drm/amd/powerplay/smumgr/tonga_smumgr.c:341-354

## Verdict
Source-confirmed: VDDCI GPIO-control path overflows SmioTable1.Pattern[4] when vddci cou. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
tonga_populate_smc_vdd_ci_table GPIO branch at tonga_smumgr.c:346-356: table->SmioTable1.Pattern[count] with Pattern[SMU_MAX_SMIO_LEVELS=4] (smu72_discrete.h:42). VddciLevelCount from vddci_voltage_table.count trimmed to SMU72_MAX_LEVELS_VDDCI=8, not 4. count 4-7 -> intra-struct overflow into SmioTable2. Requires SMU7_VOLTAGE_CONTROL_BY_GPIO VDDCI mode. No heap escape. Fix: cap VddciLevelCount at SMU_MAX_SMIO_LEVELS for GPIO mode.