# DF-1468 — VBIOS indices into clock-info arrays OOB read (`processpptables.c`)

## Verdict: REPRODUCED (source-level + harness) — latent amdgpu-powerplay bug, heap OOB read

## The bug

`sys/dev/drm/amd/powerplay/hwmgr/processpptables.c`. Representative site
`get_uvd_clock_voltage_limit_table`, lines 1099-1107:

```c
for (i = 0; i < table->numEntries; i++) {
    const UVDClockInfo *entry =
        &array->entries[table->entries[i].ucUVDClockInfoIndex];  /* :1101 OOB */
    uvd_table->entries[i].vclk = (entry->ucVClkHigh << 16) | entry->usVClkLow;
    ...
}
```

A `UCHAR` index (`ucUVDClockInfoIndex` / `ucVCEClockInfoIndex` /
`ucClockInfoIndex` / `nonClockInfoIndex`) taken directly from the VBIOS is
used to index a flex array whose real length is the sibling `ucNumEntries`
field, but the index is **never compared** to `ucNumEntries`. A crafted
index reads arbitrarily far past the array into adjacent kernel/VBIOS memory.
Sites: `:1099-1107` (UVD), `:1131-1139` (VCE), `:1576-1587` (VCE state),
`:923-935` (v2 state walk). `soft_pp_table_size` is stored (`:844`) but never
used as a bound. Enabler: malicious VBIOS flash or SR-IOV guest atom context.

## Harness proof

Marker-redzone harness (the read returns bytes it was never entitled to):

```
array->ucNumEntries   = 1 (the real length)
In-bounds  ucUVDClockInfoIndex=0 (< ucNumEntries) -> vclk=0x112233 (OK)
OOB        ucUVDClockInfoIndex=1 (>= ucNumEntries) -> vclk=0xbbbeef
read at entries[1] returned the redzone marker (0xbb/0xbeef): YES -> OOB read proven
RESULT: heap OOB read CONFIRMED (processpptables.c:1101 pattern)
```

## Fix

`fix.diff` adds `if (table->entries[i].ucUVDClockInfoIndex >=
array->ucNumEntries) return -EINVAL;` before the index deref in the
representative UVD site. The same bound check must be mirrored at the sibling
VCE / VCE-state / v2-state-walk sites.

## Module build validation (Phase 8)

All 8 amdgpu fixes applied (three touch `processpptables.c`: DF-1468, 1469,
1470 — all apply together cleanly); `amdgpu.ko` built under `-Werror`:
`processpptables.o` (12504 bytes) produced, 0 errors, `amdgpu.ko` linked.