# DF-3686 — verdict narrative

## Finding

Source-certain index-underflow family; runtime-inconclusive on this guest (no AMD GPU). Root cause 1: smu7_setup_default_dpm_tables (:950-953) ignores the -EINVAL returns of smu7_setup_dpm_tables_v0/v1, and smu7_hwmgr_backend_init (:2563-2566) likewise ignores smu7_set_private_data_based_on_pptable_v0's; a VBIOS whose V0 dependency offsets are 0 (parse-legal, processpptables.c:1304-1310) leaves sclk/mclk_table.count == 0. Root cause 2: use sites index dpm_levels[count-1] / dpm_levels[i-1] with unsigned arithmetic. Sinks: smu7_find_dpm_states_clocks_in_dpm_table (:3594/:3614-3616) - loop exits with i=0 so dpm_levels[(uint32_t)0-1] = dpm_levels[0xFFFFFFFF] = +51,539,607,540 bytes (~48 GB) - a WILD kernel READ and, when the garbage compares below the requested SCLK, a WILD WRITE of that clock value, on every power-state change; smu7_get_profiling_clk :2740 (sclk dpm_levels[count-1] read, mclk value 0 div0 is DF-1170); smu7_get_maximum_link_speed :3642-3645 (pcie dpm_levels[count-1]); smu7_get_sclk_od :4534-4539 and smu7_get_mclk_od :4576-4581 (index -1 reads plus DIV_ROUND_UP divide-by-zero when the golden value is 0); smu7_get_max_high_clocks :4745-4750; OD_RANGE print :4487/:4490; and a NULL deref of dyn_state.vddc_dependency_on_sclk at :4630/:2755 on the V0 branch. Harness reproduces the exact unsigned index arithmetic and, in crash mode, executes the verbatim kernel access: SIGSEGV (kernel equivalent: page fault in kernel mode -> panic).

## Root cause (kernel references)

- `sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:3594`
- `sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:3614`
- `sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:950`
- `sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:2740`
- `sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:3642`
- `sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:4534`
- `sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:4576`
- `sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:4745`
- `sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:1304`

## What was verified, and how

1. **Source-level certainty.** Full-file pass-2 audit of smu7_hwmgr.c (5147 lines) with
   the parse-side preconditions traced into processpptables.c / process_pptables_v1_0.c
   (VBIOS u8 counts unvalidated; offset==0 subtables parse-legal NULL) and the struct
   geometry verified in ppatomctrl.h / smu7_hwmgr.h / hardwaremanager.h /
   dm_pp_interface.h.
2. **Harness on the guest** (DragonFly 6.5-DEVELOPMENT x86_64, `cc` base toolchain):
   `zero_count_underflow.c` reproduces the exact kernel code shape and/or arithmetic with 1:1 struct
   layouts. Output in `run.log`; `run.2.log` for the live-crash phase.
   Compiled with `-O0` — at `-O2` the compiler detects the array-index UB and
   misoptimizes the accounting loops (itself a hint of what the kernel code does).
3. **Hardware absence.** The guest is virtio-only: no AMD GPU on PCI, amdgpu not
   loaded. The in-kernel trigger requires an SMU7 ASIC (CI/Topaz/Tonga/Fiji/Polaris/
   Vegam) with a crafted VBIOS, VFIO passthrough of a malicious card, or a root
   sysfs pp_table write. Per pass-2 spawn instructions this is recorded as
   **inconclusive** (matching DF-3585/DF-3619/DF-3644 precedent for the same class),
   impact none *on this guest*.

## Fix validation

fix.diff authored post-verification against the read-only sys/ tree. Not built: a
kernel rebuild with drm cannot be exercised on a GPU-less guest, so fix validation is
`not_testable`; the diffs are minimal, local, and mechanically checkable against the
cited lines.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.