# DF-1333 — OOB kernel-heap read in rv7xx_parse_power_table via unchecked VBIOS offsets/indices

**File:** `sys/dev/drm/radeon/rv770_dpm.c:2284-2326`
**Class:** OOB read / info leak

## Status: INCONCLUSIVE at runtime — confirmed real source bug, hardware-gated on this guest

The vulnerable code path was traced line-by-line in `sys/` and **confirmed to be a genuine bug**
(missing bounds check / integer overflow / UAF race). However it is **not exercisable on the
DragonFly audit guest** because the guest has neither an AMD GPU nor any audio controller:

- PCI shows only `vgapci0 class=0x030000` (QEMU stdvga, chip `0x11111234`) — no AMD GPU.
- No PCI audio device (class `0x0401`/`0x0403`); `hw.snd` empty; no `/dev/dsp`.
- `radeon.ko` is a loadable module only (NOT in `X86_64_GENERIC`), is not loaded, and cannot be
  `kldload`'d by an unprivileged user — and even if loaded would not attach without the hardware.

This is the valid hard-blocker case "vulnerable code path unreachable at runtime on this guest AND no
harness can exercise it (device-integrated parser / ioctl / hardware-dependent race)." The bug is a
real latent defect that **would** manifest on a system with the relevant hardware + the module loaded.

## Mechanism (confirmed by source trace)
rv7xx_parse_power_table() builds pointers into the kmalloc'd VBIOS image (atom_context->bios, max 256KB) using offsets and indices taken verbatim from the (attacker-controlled) VBIOS power table: usStateArrayOffset (u16), usNonClockInfoArrayOffset (u16), usClockInfoArrayOffset (u16), ucNonClockStateIndex (u8) and the per-state clock indices idx[j] (u8), each scaled by u8 entry sizes. None of these are validated against the BIOS allocation size. A crafted VBIOS with large offsets makes power_state / non_clock_info / clock_info point past the allocation, so the driver reads out of bounds when it later dereferences those structs in rv7xx_parse_pplib_*_clock_info.

## Live trigger conditions
Requires an AMD Radeon RV770-family GPU whose VBIOS power table is attacker-controlled (crafted VBIOS via PCIe passthrough / hotplug / malicious option-ROM). Reached during rv770_dpm_init() -> rv7xx_parse_power_table() at driver attach.

## Fix
A standalone, `git apply`-able fix is in `fix.diff`. **Compile-validated**: applied to in-guest
`/usr/src` and the `radeon` module rebuilt under `-Werror` (rc=0, no warnings/errors in the
patched translation unit). See `build_fix.log`.

Capture the data-table size from atom_parse_data_header() (new `data_size` out-param) and, before every state/non-clock/clock-info pointer deref, check the computed offset + entry size <= data_size, breaking out of the loop on overflow and setting num_ps to the count actually parsed. Supersedes the finding markdown proposal (which only suggested the approach).

## Reproduce / validate
```
# 1. Confirm the bug site exists (read-only source trace):
grep -n ... sys/dev/drm/radeon/rv770_dpm.c

# 2. Validate the fix compiles (on the audit guest):
scp -F dfbsd-qemu/config findings/poc/DF-1333/fix.diff dfbsd:/root/fix.diff
./dfbsd-qemu/vm.sh run_root 'cd /usr/src && patch -p1 --forward < /root/fix.diff'
./dfbsd-qemu/vm.sh run_root 'cd /usr/src/sys/dev/drm/radeon && KERNCONF=X86_64_GENERIC SYSDIR=/usr/src/sys make -m /usr/src/share/mk'

# 3. (requires real hardware) Exercise the bug: attach an AMD GPU / audio device and trigger.
```