{
  "finding_id": "DF-3686",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain index-underflow family; runtime-inconclusive on this guest (no AMD GPU). Root cause 1: smu7_setup_default_dpm_tables (:950-953) ignores the -EINVAL returns of smu7_setup_dpm_tables_v0/v1, and smu7_hwmgr_backend_init (:2563-2566) likewise ignores smu7_set_private_data_based_on_pptable_v0s; a VBIOS whose V0 dependency offsets are 0 (parse-legal, processpptables.c:1304-1310) leaves sclk/mclk_table.count == 0. Root cause 2: use sites index dpm_levels[count-1] / dpm_levels[i-1] with unsigned arithmetic. Sinks: smu7_find_dpm_states_clocks_in_dpm_table (:3594/:3614-3616) - loop exits with i=0 so dpm_levels[(uint32_t)0-1] = dpm_levels[0xFFFFFFFF] = +51,539,607,540 bytes (~48 GB) - a WILD kernel READ and, when the garbage compares below the requested SCLK, a WILD WRITE of that clock value, on every power-state change; smu7_get_profiling_clk :2740 (sclk dpm_levels[count-1] read, mclk value 0 div0 is DF-1170); smu7_get_maximum_link_speed :3642-3645 (pcie dpm_levels[count-1]); smu7_get_sclk_od :4534-4539 and smu7_get_mclk_od :4576-4581 (index -1 reads plus DIV_ROUND_UP divide-by-zero when the golden value is 0); smu7_get_max_high_clocks :4745-4750; OD_RANGE print :4487/:4490; and a NULL deref of dyn_state.vddc_dependency_on_sclk at :4630/:2755 on the V0 branch. Harness reproduces the exact unsigned index arithmetic and, in crash mode, executes the verbatim kernel access: SIGSEGV (kernel equivalent: page fault in kernel mode -> panic).",
  "exploit_chain": "",
  "evidence": "run.log: loop exits with i = 0; i - 1 = 0xffffffff, effective byte offset ... = 51539607540 bytes; run.2.log: crash mode executing the verbatim access -> SIGSEGV exit=139; VERDICT.md; fix.diff",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:3594",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:3614",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:950",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:2740",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:3642",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:4534",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:4576",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:4745",
    "sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:1304"
  ],
  "poc_changes": "No seed; wrote two-mode harness (accounting + verbatim-access crash mode) after discovering on-guest that the kernels unsigned i-1 indexes +48GB, not -12 bytes as a signed reading would suggest.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 90,
  "guest_dirty": 0,
  "build_cmd": "cc -Wall -O0 -o t zero_count_underflow.c (DragonFly 6.5 base cc, on guest)",
  "run_cmd": "cd /tmp/DF-3686 && ./t && ./t crash",
  "code_hash": "b2fe7417045df5bd44a15adebc49947658454fb12192a0735af373325638c6db",
  "notes": "Guest virtio-only (no AMD GPU: pciconf shows only QEMU 0x1237/0x1111; amdgpu.ko/drm.ko present in /boot/kernel but unloaded). Harness proves the primitive/arithmetic with verbatim kernel code shape and 1:1 struct layouts; the in-kernel trigger needs an SMU7 ASIC + crafted VBIOS / VFIO / root pp_table write. Compiled -O0: -O2 detects the index UB and misoptimizes the accounting.",
  "recommended_fix": "Propagate smu7_setup_dpm_tables_v0/v1 failures out of smu7_setup_default_dpm_tables, guard every dpm_levels[count-1]/[i-1] use with count>0 (find_dpm_states, profiling clk, max link speed, sclk/mclk_od, max_high_clocks, OD_RANGE print), and NULL-check the V0 dependency tables in smu7_get_sclks/smu7_get_profiling_clk.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree after source+harness verification; not built (no AMD hardware on guest).",
  "fix_evidence": "findings/poc/DF-3686/fix.diff"
}