# DF-3614 — Heap OOB write past SISLANDS_SMC_STATETABLE.lowSMIO[32] via untrimmed SVI2 VDDCI voltage-table count in si_populate_smc_voltage_table

**Severity:** Medium  **Confidence:** certain  **Status:** reproduced (harness)
**Impact:** dos

## What

Mixed-VRM VBIOS: VDDC via GPIO_LUT (voltage_control true) + VDDCI via SVID2 (vddci_control false, vddci_control_svi2 true). si_construct_voltage_tables:3998-4004 fills vddci_voltage_table.count = vddci_dependency_on_mclk.count (u8, up to 255) with NO trim (the GPIO paths trim at :3973/:3993/:4020). si_populate_smc_voltage_tables then takes the non-SVI2-VDDC else branch (:4058 false since VDDC is GPIO) and at :4079-4080 calls si_populate_smc_voltage_table, whose loop at :4046 OR-writes table->lowSMIO[i] for i<count into the packed STATETABLE embedded in the kzalloc'd si_power_info (si_dpm.h:196). count 33..255 writes up to 1020 bytes past lowSMIO[0] (struct is 3012 B; overflow is contained within the si_power_info allocation) corrupting voltageMaskTable, phaseMaskTable, dpm2Params, initialState/ACPIState/ULVState/driverState and dpmLevels — data that si_init_smc_table uploads verbatim to the GPU SMC at :4779-4781, programming wrong voltage masks / TDP limits / state clocks (hardware misconfiguration, undervoltage/overvoltage risk). Harness with verbatim packed struct replicas from sislands_smc.h confirms the exact corrupted fields; gcc itself flags the replica loop (-Warray-bounds: 'iteration 32 invokes undefined behavior').

## Reproduce

```
sh build.sh   # cc -O2 -Wall -o harness harness.c
sh run.sh     # prints [A] buggy-path behaviour, [B] fixed-path behaviour
```

Expected decisive output (see run.log): the `[A]` section shows the fault or
corruption the kernel would take; the `[B]` section shows the behaviour with
fix.diff applied.

No AMD GPU is attached to the audit QEMU guest (virtio-only), so the radeon
DPM path cannot be exercised live; the harness replicates the exact kernel
expressions with crafted-VBIOS inputs (house methodology, cf. DF-1137..1140).

## Fix

`fix.diff` — validated: `git apply --check` clean; `make si_dpm.o` in
sys/dev/drm/radeon with KERNBUILDDIR=/usr/obj/usr/src/sys/X86_64_GENERIC
compiles -Werror clean with all five pass-2 fixes stacked; harness `[B]`
shows the primitive gone.