{
  "finding_id": "DF-3684",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain kernel STACK buffer overflow; runtime-inconclusive on this guest (no AMD GPU). smu7_get_sclks (smu7_hwmgr.c:4625-4632) and smu7_get_mclks (:4662-4672) write clocks->clock[i]/latency[i] for i < dep_table->count with no bound against MAX_NUM_CLOCKS=16 (dm_pp_interface.h:161-167). The count is the raw VBIOS ucNumEntries (u8 <= 255, unvalidated by both processpptables.c:391 and process_pptables_v1_0.c:436/468/389). The sole caller chain places the struct on the stack: dm_pp_get_clock_levels_by_type (amdgpu_dm_pp_smu.c:296-316) declares struct amd_pp_clocks pp_clks = { 0 }; and passes it through amd_pp_dpm_get_clock_by_type -> phm_get_clock_by_type -> smu7_get_clock_by_type. With count=255 the loops write 239 u32s (956 bytes) past each 16-element array - 892 bytes beyond the 132-byte struct - into the callers stack frame (validation_clks, saved registers, return path) with attacker-controlled u32 values (VBIOS clk * 10). Reached on display mode validation (DC init / mode set / hotplug). The V0 branch additionally NULL-derefs hwmgr->dyn_state.vddc_dependency_on_mclk when the VBIOS omits the table (offset 0 -> NULL is parse-legal). Harness confirmed full accounting plus a live stack smash killing the process (SIGSEGV), i.e. in-kernel: kernel-mode page fault or silent control-flow corruption.",
  "exploit_chain": "",
  "evidence": "run.log: OOB u32 writes past clock[16] and latency[16]: 239 each (956 bytes each), bytes written past end of amd_pp_clocks struct: 892, return-address model slot: 0x1dc130001d5f88 (expected 0xdeadbeef00000000); run.2.log: phase-2 live stack-local smash ends in SIGSEGV exit=139; VERDICT.md; fix.diff",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:4625",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:4632",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:4662",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:4667",
    "sys/dev/drm/amd/include/dm_pp_interface.h:161",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c:296",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c:303"
  ],
  "poc_changes": "No seed; wrote two-phase harness: (1) padded-frame accounting of every OOB write, (2) real stack-local smash demonstrating SIGSEGV.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 90,
  "guest_dirty": 0,
  "build_cmd": "cc -Wall -O0 -o t pp_clocks_stack.c (DragonFly 6.5 base cc, on guest)",
  "run_cmd": "cd /tmp/DF-3684 && ./t",
  "code_hash": "3f676cf542adc1fcbe758fa658549d06f96455904e73c21246ccee7324905ccd",
  "notes": "Guest virtio-only (no AMD GPU: pciconf shows only QEMU 0x1237/0x1111; amdgpu.ko/drm.ko present in /boot/kernel but unloaded). Harness proves the primitive/arithmetic with verbatim kernel code shape and 1:1 struct layouts; the in-kernel trigger needs an SMU7 ASIC + crafted VBIOS / VFIO / root pp_table write. Compiled -O0: -O2 detects the index UB and misoptimizes the accounting.",
  "recommended_fix": "Bound both copy loops in smu7_get_sclks/smu7_get_mclks to MAX_NUM_CLOCKS, report the truncated count, and NULL-check the V0 dyn_state tables.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree after source+harness verification; not built (no AMD hardware on guest).",
  "fix_evidence": "findings/poc/DF-3684/fix.diff"
}