# DF-1451 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** certain

## Finding
SDMA firmware ucode payload length/offset not validated against firmware blob size - heap OOB read

## Source Location
sys/dev/drm/amd/amdgpu/sdma_v4_0.c:918-929

## Verdict
Source-confirmed: SDMA firmware ucode payload length/offset not validated against firmwa. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
sdma_v4_0_load_microcode at sdma_v4_0.c:920-929: fw_size=ucode_size_bytes/4, fw_data=fw->data+ucode_array_offset_bytes. Neither validated vs fw->datasize. amdgpu_ucode_validate only checks datasize==size_bytes. Crafted fw with size_bytes==filesize but ucode_size_bytes=0xFFFFFFFF -> ~4GB OOB read from fw kmalloc into GPU register. Root-controlled firmware file. Sibling of DF-1256/1316 family. Fix: validate offset+size<=datasize in load_microcode and amdgpu_ucode_validate.