# DF-1574 — get_vddc_lookup_table heap OOB write (amdgpu powerplay)

## At a glance

| Field       | Value |
|-------------|-------|
| Finding     | DF-1574 |
| Severity    | High |
| Class       | CWE-787 Out-of-bounds Write |
| File        | sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:168-190 |
| Verdict     | NOT REPRODUCED ON GUEST (real bug, unreachable runtime path) |
| Impact      | none (on this guest); latent memory-corruption |
| Confidence  | certain (source-traced line-by-line) |

## The bug, in one sentence

`get_vddc_lookup_table()` allocates `4 + 10*max_levels` bytes but loops
`ucNumEntries` times writing 10 bytes per iteration, where `ucNumEntries`
(0..255) comes from VBIOS and the two callers pass `max_levels=16` — so
a hostile VBIOS with `ucNumEntries>16` writes ~2.4 KB past the
kmalloc-256 slab object.

## Reproduce on this guest

**Cannot run.**  The affected source file is part of the `amdgpu` KLD
module, which is not in `X86_64_GENERIC`, not loaded, and there is no
AMD GPU on the QEMU guest.  See `VERDICT.md` for the full reachability
analysis and `fix_build.log` for the standalone patched-source compile.

## Apply the fix

```sh
cd /usr/src
patch -p1 < findings/poc/DF-1574/fix.diff
# In sys/dev/drm/amd/amdgpu:
make   # rebuild amdgpu.ko
```

## Files in this folder

| File              | Purpose |
|-------------------|---------|
| `VERDICT.md`      | Full analysis: bug, reachability, fix, threat model |
| `fix.diff`        | git-apply-able unified diff (clamps count + loop) |
| `fix_build.log`   | Translation-unit compile log (patched source, -Werror clean) |
| `env.txt`         | Guest environment + PCI/module state |
| `manifest.json`   | Machine-readable catalog |