# VERDICT -- DF-2021 (Low)

**Verdict:** REPRODUCED (source-only, latent)

**Impact:** latent signed-index OOB on entry[] (CWE-129); not currently reachable (only const callers); HW-gated (needs Vega12 AMD GPU), source-confirmed

**Confidence:** speculative

## Mechanism (source-traced)

vega12_copy_table_from_smc (vega12_smumgr.c:41) and _to_smc (:79) declare int16_t table_id but validate only 'table_id < TABLE_COUNT(10)' at :46/:84. A negative table_id (e.g. -1) satisfies -1<10 and is used as an array index entry[table_id] at :48-68/:86-108 with memcpy length entry[table_id].size. NOT currently reachable: the only callers pass compile-time constants (TABLE_PPTABLE=0, TABLE_WATERMARKS=1). Latent API-contract trap.

## Why not runtime-reproduced

The guest (DragonFlyBSD 6.5-DEVELOPMENT #0 master DEV, KVM) has NO matching
hardware: pciconf shows no mfi/tws/iir RAID controller and no amdgpu/DRM GPU;
the driver therefore cannot attach and the vulnerable path is not runtime-
triggerable here. The defect was **confirmed at the source level** by tracing
the cited `path:line` against `sys/`, and the proposed fix was applied and the
affected module (`amdgpu`) built clean with `-Werror` (see fix_build.log).

## Fix

vega12_smumgr.c:46 and :84: change the bound to 'table_id >= 0 && table_id < TABLE_COUNT' so negative int16_t values are rejected.

The standalone, git-apply-able diff is `fix.diff`.