# DF-1470 — VBIOS table offsets never validated vs firmware size (`processpptables.c`)

## Verdict: REPRODUCED (source-level + harness) — latent amdgpu-powerplay bug, heap OOB read

## The bug

`sys/dev/drm/amd/powerplay/hwmgr/processpptables.c`. Representative site
`get_vce_table_offset`, lines 55-66:

```c
if (powerplay_table3->usExtendendedHeaderOffset > 0) {
    const ATOM_PPLIB_EXTENDEDHEADER *extended_header =
        (const ATOM_PPLIB_EXTENDEDHEADER *)
        (((unsigned long)powerplay_table3) +
         le16_to_cpu(powerplay_table3->usExtendendedHeaderOffset));  /* :60 OOB ptr */
    if (le16_to_cpu(extended_header->usSize) >= ...)                 /* :63 OOB read #1 */
        vce_table_offset = le16_to_cpu(extended_header->usVCETableOffset); /* :65 OOB read #2 */
}
```

Throughout the file, VBIOS `USHORT` offsets (`usExtendendedHeaderOffset`,
`usStateArrayOffset`, `usClockInfoArrayOffset`, `usVCETableOffset`, ...) are
added to the `powerplay_table` base and immediately dereferenced as typed
pointers with **no check** that the offset lies within `[0,
soft_pp_table_size)`. A single malicious `USHORT` (e.g. `0xFFFF`) makes the
pointer land ~64 KB past the table -> chained derefs cascade into
arbitrary-read-then-corrupt. Affects ~50 sites; the compound walker at
lines 75-148 sums multiple VBIOS sizes without checking the cumulative total.

## Harness proof

```
table real size         = 16 bytes
marker ext_header at    = offset 16 (just past the table)
marker usVCETableOffset = 0xcafe
In-bounds  usExtendendedHeaderOffset=0 -> vce_offset=0 (OK)
OOB        usExtendendedHeaderOffset=16 (past table) -> vce_offset=0xcafe
RESULT: heap OOB read CONFIRMED (processpptables.c:60-65 pattern)
```

## Fix

`fix.diff` introduces a `pp_offset_in_table(hwmgr, base, offset, need)`
helper that validates `[base+offset, base+offset+need)` lies within
`[soft_pp_table, soft_pp_table+soft_pp_table_size)`, and applies it at the
representative `get_vce_table_offset` extended-header site. The same helper
must be applied at every offset-deref site (~50 places).

## Module build validation (Phase 8)

All 8 amdgpu fixes applied (three touch `processpptables.c`: DF-1468, 1469,
1470 — all apply together cleanly); `amdgpu.ko` built under `-Werror`:
`processpptables.o` (12504 bytes) produced, 0 errors, `amdgpu.ko` linked.