# DF-1586 — vega10 get_vddc_lookup_table heap OOB write (amdgpu powerplay)

## At a glance

| Field       | Value |
|-------------|-------|
| Finding     | DF-1586 (sibling of DF-1574) |
| Severity    | High |
| Class       | CWE-787 Out-of-bounds Write |
| File        | sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:1014-1043 |
| Verdict     | NOT REPRODUCED ON GUEST (real bug, unreachable runtime path) |
| Impact      | none (on this guest); latent memory-corruption |
| Confidence  | certain (source-traced line-by-line) |

## The bug, in one sentence

vega10's `get_vddc_lookup_table()` allocates `4 + 10*max_levels` bytes
(callers pass 4 or 8) but loops `ucNumEntries` times walking 10 bytes
per iteration; with a hostile VBIOS `ucNumEntries=255` it writes ~2.5 KB
past the kmalloc-64 slab object.

## Reproduce on this guest

**Cannot run.**  Part of the `amdgpu` KLD module — not in
`X86_64_GENERIC`, not loaded, no AMD GPU present.  See `VERDICT.md` for
full reachability analysis and `fix_build.log` for the standalone
patched-source compile.

## Apply the fix

```sh
cd /usr/src
patch -p1 < findings/poc/DF-1586/fix.diff
# In sys/dev/drm/amd/amdgpu:
make   # rebuild amdgpu.ko
```

## Files in this folder

| File              | Purpose |
|-------------------|---------|
| `VERDICT.md`      | Full analysis: bug, reachability, fix, threat model |
| `fix.diff`        | git-apply-able unified diff (clamps count + loop) |
| `fix_build.log`   | Translation-unit compile log (patched source, -Werror clean) |
| `env.txt`         | Guest environment + PCI/module state |
| `manifest.json`   | Machine-readable catalog |