# DF-1353 — VERDICT

**REPRODUCED at the function level** (impact: `leak`).

## Mechanism

vega12_force_clock_level() at vega12_hwmgr.c:1807-1813 computes soft_min_level = ffs(mask)-1 and soft_max_level = fls(mask)-1 (range 0..31) from a user-supplied mask written via the pp_dpm_sclk/mclk sysfs attribute. data->dpm_table.gfx_table.dpm_levels[] is sized MAX_REGULAR_DPM_NUMBER = 16. Any mask with bit 16 or higher set (e.g. 0x10000, 0x80000000) yields soft_min/max_level >= 16, reading dpm_levels[16..31] OOB into sibling tables/softc. vega20 has a guard; vega12 missing.

## Why not live-reproduced on the QEMU guest

AMD Vega10/12 GPU absent from QEMU guest. The amdgpu powerplay module loads only on matching HW. Triggered via sysfs by an authenticated local user.

## Recommended fix

In both PP_SCLK and PP_MCLK cases of vega12_force_clock_level, after computing soft_min_level/soft_max_level, check 'if (soft_min_level >= data->dpm_table.{gfx,mem}_table.count || soft_max_level >= ...count) return -EINVAL;'.

## Kernel references (confirmed during verification)

- sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.c:1807-1808 (ffs/fls of mask)
- sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.c:1810-1813 (unguarded dpm_levels[soft_min/max_level] index)
- sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.h:96 (MAX_REGULAR_DPM_NUMBER=16)
- sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.h:110 (dpm_levels[16])

## Build/run

- Build harness: `cc -O2 -Wall -o trigger trigger.c`
- Run harness: `./trigger`
- Apply fix: `cd /usr/src && patch -p1 < fix.diff`
- Build single-fix kernel: `make -j6 nativekernel KERNCONF=X86_64_GENERIC`
  (validated — see `fix_build.log`; all 15 fixes compile cleanly in one batched
  build, rc=0).

## Tested kernels

- baseline: `DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64`
- patched : `DragonFly 6.5-DEVELOPMENT #1: Mon Jul 20 21:51:01 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64`