# DF-1346 — Heap buffer overflow populating VCE/UVD SMC levels from an unclamped VBIOS MM-dependency count

**File:** `sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:1298 and 1404`
**Class:** heap buffer overflow (write past fixed SMC level array)

## Status: INCONCLUSIVE at runtime — confirmed real source bug, hardware-gated on this guest

The vulnerable code path was traced line-by-line in `sys/` and **confirmed to be a genuine bug**
(missing bounds check / integer overflow / UAF race). However it is **not exercisable on the
DragonFly audit guest** because the guest has neither an AMD GPU nor any audio controller:

- PCI shows only `vgapci0 class=0x030000` (QEMU stdvga, chip `0x11111234`) — no AMD GPU.
- No PCI audio device (class `0x0401`/`0x0403`); `hw.snd` empty; no `/dev/dsp`.
- `amdgpu.ko` is a loadable module only (NOT in `X86_64_GENERIC`), is not loaded, and cannot be
  `kldload`'d by an unprivileged user — and even if loaded would not attach without the hardware.

This is the valid hard-blocker case "vulnerable code path unreachable at runtime on this guest AND no
harness can exercise it (device-integrated parser / ioctl / hardware-dependent race)." The bug is a
real latent defect that **would** manifest on a system with the relevant hardware + the module loaded.

## Mechanism (confirmed by source trace)
polaris10_populate_smc_vce_level() sets `table->VceLevelCount = (uint8_t)(mm_table->count)` (:1298) then loops `count < VceLevelCount` writing table->VceLevel[count] (:1301-1330). VceLevel[] is a fixed array of SMU74_MAX_LEVELS_VCE = 8 (smu74.h:139 / smu74_discrete.h:287). mm_table->count comes straight from the VBIOS ucNumEntries (u8, 0-255) with no clamp (process_pptables_v1_0.c:708), so count>8 overflows VceLevel[] into the following fields of SMU74_Discrete_DpmTable (and, for the smc_state_table, into polaris10_smumgr fields such as power_tune_defaults which is later dereferenced). polaris10_populate_smc_uvd_level() has the identical flaw for UvdLevel[SMU74_MAX_LEVELS_UVD=8] at :1404-1407.

## Live trigger conditions
Requires an AMD Polaris10 GPU with amdgpu attached whose VBIOS MM-dependency table has ucNumEntries > 8 (crafted VBIOS via passthrough/hotplug). Reached during powerplay init. QEMU audit guest has no AMD GPU, no /dev/dri, amdgpu.ko not loaded => unreachable here.

## Fix
A standalone, `git apply`-able fix is in `fix.diff`. **Compile-validated**: applied to in-guest
`/usr/src` and the `amdgpu` module rebuilt under `-Werror` (rc=0, no warnings/errors in the
patched translation unit). See `build_fix.log`.

Clamp the count to the fixed array size using the same ternary already used elsewhere in this file for the pcie-link levels (~:2191): `VceLevelCount = (uint8_t)((SMU74_MAX_LEVELS_VCE < mm_table->count) ? SMU74_MAX_LEVELS_VCE : mm_table->count)` and the analogous line for UvdLevelCount/SMU74_MAX_LEVELS_UVD. Supersedes the finding proposal (clamp count to SMU74_MAX_LEVELS_*).

## Reproduce / validate
```
# 1. Confirm the bug site exists (read-only source trace):
grep -n ... sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c

# 2. Validate the fix compiles (on the audit guest):
scp -F dfbsd-qemu/config findings/poc/DF-1346/fix.diff dfbsd:/root/fix.diff
./dfbsd-qemu/vm.sh run_root 'cd /usr/src && patch -p1 --forward < /root/fix.diff'
./dfbsd-qemu/vm.sh run_root 'cd /usr/src/sys/dev/drm/amd/amdgpu && KERNCONF=X86_64_GENERIC SYSDIR=/usr/src/sys make -m /usr/src/share/mk'

# 3. (requires real hardware) Exercise the bug: attach an AMD GPU / audio device and trigger.
```