# DF-1472 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
get_clock_voltage_limit reads entries[0] without numEntries check; off-by-one in get_state_entry_v2

## Source Location
sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:432-913

## Verdict
Source-confirmed: get_clock_voltage_limit reads entries[0] without numEntries check; off. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
(1) get_clock_voltage_limit at processpptables.c:428-440 indexes table->entries[0] without verifying ucNumEntries>=1; VBIOS limit table with numEntries=0 reads one record past header (reachable when usMaxClockVoltageOnDCOffset != 0). (2) get_state_entry_v2 at processpptables.c:784 uses entry_index <= ucNumEntries (should be <); combined with caller permissive check at 913 allows entry_index==ucNumEntries -> one state past last returned and dereferenced. Latent unless future caller changes.