# DF-1469 — VBIOS entry count trusted without validation (`processpptables.c`)

## Verdict: REPRODUCED (source-level + harness) — latent amdgpu-powerplay bug, heap OOB read

## The bug

`sys/dev/drm/amd/powerplay/hwmgr/processpptables.c`. Representative site
`get_clock_voltage_dependency_table`, lines 383-399:

```c
table_size = sizeof(unsigned long) +
    sizeof(struct phm_clock_voltage_dependency_table) *
    table->ucNumEntries;                          /* :383 -- trusted VBIOS count */
dep_table = kzalloc(table_size, GFP_KERNEL);
dep_table->count = (unsigned long)table->ucNumEntries;
for (i = 0; i < dep_table->count; i++) {
    dep_table->entries[i].clk = ... table->entries[i].ucClockHigh ...;  /* :394 OOB */
    dep_table->entries[i].v   = ... table->entries[i].usVoltage ...;    /* :397 OOB */
}
```

Every table parser sizes the destination buffer by the VBIOS-supplied `UCHAR`
count AND iterates that many times reading `table->entries[i]` from the VBIOS
region. The count is **never validated** to fit inside the firmware image
(`soft_pp_table_size` is available at `:844` but unused). Sites:
`:383-399` (clock_voltage_dep), `:1089-1107` (uvd), `:1122-1139` (vce),
`:1153-1167` (samu), `:1181-1195` (acp), `:1379-1399` (cac_leakage),
`:1520-1537` (phase_shed). Inflated `ucNumEntries=255` for a small table ->
OOB read of adjacent kernel memory, parsed as clocks/voltages (driving MMIO
writes -> corruption, or leaked via sysfs `pp_dpm_sclk` / hwmon).

## Harness proof

```
real ucNumEntries        = 2 (what the image actually holds)
marker clk=0xabcdef volt=0x1234 placed in redzone slots 2..7
In-bounds  ucNumEntries=2 -> clk[0]=0x11000 volt[0]=0x800 (OK)
OOB        ucNumEntries=8 (inflated) -> clk[2]=0xabcdef volt[2]=0x1234
RESULT: heap OOB read CONFIRMED (processpptables.c:393 count loop)
```

## Fix

`fix.diff` caps `num_entries` at a sane hardware maximum (128) in the
representative `get_clock_voltage_dependency_table` parser; the same defensive
bound must be applied at every sibling parser (uvd/vce/samu/acp/cac_leakage/
phase_shed).

## Module build validation (Phase 8)

All 8 amdgpu fixes applied (three touch `processpptables.c`: DF-1468, 1469,
1470); `amdgpu.ko` built under `-Werror`: `processpptables.o` (12504 bytes)
produced, 0 errors, `amdgpu.ko` linked.