# DF-1368 -- Heap+stack OOB in vegam CAC/clock_stretcher/AVFS (unclamped counts)

**File:** `sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:515`
**Class:** memory corruption (heap OOB / OOB write / OOB read)

## Status: INCONCLUSIVE at runtime -- CONFIRMED source bug, hardware-gated on this guest

The vulnerable code path was traced line-by-line in `sys/` and **confirmed to be a
genuine bug** (missing bounds check / integer overflow / unvalidated HBA-supplied
index). However it is **not exercisable on the DragonFly audit guest** because the
guest has no amdgpu hardware:

- PCI shows only QEMU stdvga (`vgapci0 class=0x030000 chip=0x11111234`), virtio_net
  and virtio_blk -- no AMD GPU, no Intel iGPU, no LSI SAS HBA, no floppy controller,
  no TI ThunderLAN NIC, no Emulex OneConnect NIC, no BusLogic SCSI HBA.
- The amdgpu driver (whether a loadable .ko or compiled-in) never attaches.
- `/dev/fd0`, `/dev/dri`, `/dev/dsp*` do not exist on this guest.

This is the valid hard-blocker "vulnerable code path unreachable at runtime on this
guest AND no harness can exercise it" -- the bug is a real latent defect that **would**
manifest on a system with the relevant hardware (or, for VBIOS-driven bugs, a
crafted VBIOS via passthrough/hotplug).

## Mechanism (confirmed by source trace)

Three independent unclamped loops, all driven by VBIOS counts, writing fixed-size
arrays:
  * vegam_populate_cac_table :515 -- count from lookup_table->count writes
    BapmVddcVidLoSidd/HiSidd/HiSidd2[count], each [SMU75_MAX_LEVELS_VDDC=16].
  * vegam_populate_clock_stretcher_data_table :1515 -- sclk_table->count writes
    smc_state_table.Sclk_voltageOffset[i] (heap OOB, array [8]).
  * vegam_populate_avfs_parameters :1636 -- sclk_table->count writes
    AVFS_meanNsigma.Static_Voltage_Offset[i] and AVFS_SclkOffset.Sclk_Offset[i]
    (both stack-local structs of size [8] -> return-address corruption).
All counts come from VBIOS ucNumEntries unclamped.

## Live trigger conditions
Requires the amdgpu hardware (and the driver loaded). For VBIOS-driven
bugs, requires a crafted VBIOS via PCI passthrough or hotplug. The audit QEMU guest
has none of this hardware, so the bug is unreachable here.

## Fix
A standalone, `git apply`-able fix is in `fix.diff`. **Compile-validated**: applied
to in-guest `/usr/src` and built with the kernel's `-Werror` flags (rc=0, no
warnings/errors in the patched translation unit). See `build_fix.log`.

Added `&& count < SMU75_MAX_LEVELS_VDDC` to the CAC loop and `&& i <
NUM_VFT_COLUMNS` (=8) to both the clock_stretcher and AVFS loops. (matches
finding proposal: clamp each loop to destination array size.)

## Reproduce / validate
```
# 1. Confirm the bug site (read-only source trace):
grep -n ... sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c

# 2. Compile-validate the fix on the audit guest:
scp -F dfbsd-qemu/config findings/poc/DF-1368/fix.diff dfbsd:/root/DF-1368.fix.diff
./dfbsd-qemu/vm.sh run_root 'cd /usr/src && patch -p1 --forward < /root/DF-1368.fix.diff'
# Then either:
#   cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC        # kernel-internal drivers
# OR
#   cd /usr/src/sys/dev/drm/<module> && KERNCONF=X86_64_GENERIC SYSDIR=/usr/src/sys make -m /usr/src/share/mk  # GPU modules

# 3. (requires real hardware) Exercise the bug: attach the HW and trigger.
```