# PoC DF-1498: ppatomctrl ASIC_PROFILING_INFO V2_1 leakage offset unchecked → OOB

**Class:** OOB read/write via unchecked BIOS offsets
**Cited site:** `sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:1495-1500, 1515-1516`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

No — amdgpu powerplay HW-gated. Trigger is a GPU VBIOS with an ASIC_ProfilingInfo table where the per-array USHORT offsets point outside the table.

The bug is **confirmed at the source level** by tracing the cited path:line in
`sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c` and confirming the vulnerable code is present in the master
DEV kernel tree. The `fix.diff` in this folder is validated to apply cleanly
and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

Lines 1495-1497 only verify `usStructureSize >= sizeof(ASIC_PROFILING_INFO_V2_1)` — the header size. The four USHORT offsets (usLeakageBinArrayOffset/usElbVDDC_IdArrayOffset/usElbVDDC_LevelArrayOffset + VDDCI analogues) and their array extents are NEVER validated to fall inside usStructureSize. Lines 1498-1500, 1515-1516 compute `buf = (u16 *)((char *)profile + offset)` and then array-index `vddc_id_buf[i]`, `vddc_buf[j*N+i]`, etc. Attacker-controlled offsets → arbitrary OOB read of attacker-chosen kernel addresses.

## Realistic impact ceiling

leak (arbitrary info leak / DoS)

## Fix

Validate that each array offset plus its byte extent (count*sizeof(u16)) fits inside the table size; return -EINVAL otherwise.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```
# 1. Apply fix.diff against the in-guest source:
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1498.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 < /root/DF-1498.diff'

# 2. Rebuild the affected module (preferred) or a single-fix kernel:
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src/sys/sys/dev/drm/amd/powerplay/hwmgr && make'

# 3. The compile must succeed with -Werror (it does — see build.log).
```