# DF-1335 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
Off-by-one OOB read of vddc_table[MAX_NO_VREG_STEPS=32] in rv770_populate_smc_vddc_table

## Source Location
sys/dev/drm/radeon/rv770_dpm.c:1124-1274

## Verdict
Source-confirmed: Off-by-one OOB read of vddc_table[MAX_NO_VREG_STEPS=32] in rv770_popul. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
rv770_populate_smc_vddc_table at rv770_dpm.c:1135-1142: search loop for(i=0;i<valid_vddc_entries&&max>vddc_table[i].vddc;i++). When max>all entries, i==valid_vddc_entries==32 (max from rv770_construct_vddc_table). vddc_table[32] is 1 past [MAX_NO_VREG_STEPS=32] array. Reads adjacent softc fields. Crafted VBIOS: 32 voltage steps + state requesting vddc above max. Fix: clamp i=valid_vddc_entries-1.