# DF-2021 PoC — Signed table_id negative-index OOB (speculative / latent)

## Status

NOT currently reachable from any in-tree caller. The only callers of
`smum_smc_table_manager` pass compile-time constants (`TABLE_PPTABLE=0`,
`TABLE_WATERMARKS=1`). No ioctl/debugfs forwards a user-controlled `table_id`.

## Latent primitive

If a future code path routes a user- or firmware-controlled 16-bit table
selector through `vega12_smc_table_manager(hwmgr, buf, 0xFFFF, true)`:

1. `table_id = 0xFFFF` narrows to `int16_t -1`
2. `(-1 < TABLE_COUNT=10)` passes the guard
3. `entry[-1]` is read from adjacent kernel heap memory
4. The `.size` field controls a `memcpy` length
5. The `.table` pointer controls source/destination

Result: controllable kernel OOB read (rw=true) or OOB write (rw=false) with
attacker-chosen pointer and length.

Filed as speculative precisely because no forwarding path exists today.