{
  "finding_id": "DF-3683",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain heap OOB write; runtime-inconclusive on this guest (no AMD GPU). phm_get_svi2_voltage_table_v0 (smu7_hwmgr.c:219-239, defined only in this file) copies voltage_dependency_table->count entries into voltage_table->entries[PP_ATOMCTRL_MAX_VOLTAGE_ENTRIES=32] (ppatomctrl.h:45,211). For V0 boards the count is the raw VBIOS ucNumEntries (u8, 1..255, no upper bound: processpptables.c:375-404), and the call sites (smu7_hwmgr.c:265-268 MVDD, :285-289 VDDCI, :313-317 VDDC) pass dyn_state.{mvdd,vddci,vddc}_dependency_on_mclk. The trimming at :323-349 runs AFTER construction and only clamps the count field - it cannot undo the writes. With count=255 the loop writes 223 entries (1784 bytes) past entries[31], clobbering the adjacent vddci/mvdd/vddgfx voltage tables and the following members of the heap-allocated struct smu7_hwmgr (smu7_hwmgr.h:250-254). Precondition: crafted VBIOS (or VFIO/root sysfs pp_table) declaring SVID2 voltage control (atomctrl_is_voltage_controlled_by_gpio_v3) plus a dependency table with >32 entries. smu7 twin of DF-3585/DF-3619/DF-3644 (si/ci); the V1 twin of the same construction lives in smu_helper.c (DF-1797). Harness (verbatim function, real struct layouts) confirmed 223 forged OOB writes with VBIOS-controlled u16 voltage values corrupting canaries modelling the adjacent backend fields.",
  "exploit_chain": "",
  "evidence": "run.log: out-of-bounds entry writes observed: 223, vddci_voltage_table.count corrupted: 632, canary[0] CORRUPTED: 0xa5a502dd (the crafted 600+i mV values visible in the smashed words); VERDICT.md; fix.diff (clamp count to PP_ATOMCTRL_MAX_VOLTAGE_ENTRIES before the loop)",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:219",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:232",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:263",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:313",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:323",
    "sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.h:45",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.h:250",
    "sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:391"
  ],
  "poc_changes": "Seed had no runnable PoC; wrote a faithful unit harness (verbatim kernel function + 1:1 struct layouts from ppatomctrl.h/smu7_hwmgr.h with canary-guarded adjacency) since the real trigger requires an AMD SMU7 ASIC with a crafted VBIOS.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 90,
  "guest_dirty": 0,
  "build_cmd": "cc -Wall -O0 -o t svi2_v0_overflow.c (DragonFly 6.5 base cc, on guest)",
  "run_cmd": "cd /tmp/DF-3683 && ./t",
  "code_hash": "bb32dc1443cf5848c7bc341aad9a7b4638d969458c643d200cff822367862632",
  "notes": "Guest virtio-only (no AMD GPU: pciconf shows only QEMU 0x1237/0x1111; amdgpu.ko/drm.ko present in /boot/kernel but unloaded). Harness proves the primitive/arithmetic with verbatim kernel code shape and 1:1 struct layouts; the in-kernel trigger needs an SMU7 ASIC + crafted VBIOS / VFIO / root pp_table write. Compiled -O0: -O2 detects the index UB and misoptimizes the accounting.",
  "recommended_fix": "Clamp voltage_dependency_table->count to PP_ATOMCTRL_MAX_VOLTAGE_ENTRIES before the copy loop in phm_get_svi2_voltage_table_v0 (and fail loudly), mirroring the trim that already happens too late at smu7_hwmgr.c:323-349.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree after source+harness verification; not built (no AMD hardware on guest).",
  "fix_evidence": "findings/poc/DF-3683/fix.diff"
}