# DF-1354 — VERDICT

**REPRODUCED at the function level** (impact: `panic`).

## Mechanism

vega12_apply_clocks_adjust_rules() at vega12_hwmgr.c:1973: 'for (i = 0; i < data->mclk_latency_table.count - 1; i++)'. count is uint32, defaults to 0 (kzalloc'd struct). count == 0 -> count-1 wraps to 0xFFFFFFFF, loop reads mclk_latency_table.entries[i] (16-entry) and dpm_table.dpm_levels[i] OOB. Reached when disable_mclk_switching is true (multi-monitor config). vega10 uses 'i < count' (safe); vega20 has the same bug.

## Why not live-reproduced on the QEMU guest

AMD Vega10/12 GPU absent from QEMU guest. The amdgpu powerplay module loads only on matching HW. Triggered at display-config change with multi-monitor.

## Recommended fix

In vega12_apply_clocks_adjust_rules, check 'if (dpm_table->count == 0) return -EINVAL;' and change loop bound to 'for (i = 0; i < data->mclk_latency_table.count && i < dpm_table->count && i < MAX_REGULAR_DPM_NUMBER - 1; i++)'.

## Kernel references (confirmed during verification)

- sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.c:1973 (for loop with count - 1)
- sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.h:212 (entries[16] array)
- sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.h:110 (dpm_levels[16])

## Build/run

- Build harness: `cc -O2 -Wall -o trigger trigger.c`
- Run harness: `./trigger`
- Apply fix: `cd /usr/src && patch -p1 < fix.diff`
- Build single-fix kernel: `make -j6 nativekernel KERNCONF=X86_64_GENERIC`
  (validated — see `fix_build.log`; all 15 fixes compile cleanly in one batched
  build, rc=0).

## Tested kernels

- baseline: `DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64`
- patched : `DragonFly 6.5-DEVELOPMENT #1: Mon Jul 20 21:51:01 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64`