{
  "finding_id": "DF-3688",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain output-budget overflow, precondition shared with DF-1166 (VBIOS dep count > 8 is unvalidated); runtime-inconclusive on this guest (no AMD GPU). smu7_print_clock_levels sprintf()s one line per DPM level into the callers sysfs page buffer (amdgpu_pm.c amdgpu_get_pp_dpm_sclk/mclk/pcie pass the raw 4096-byte kernfs buf; pp_od_clk_voltage likewise). The loops run to sclk_table->count / mclk_table->count / pcie_table->count / odn_*->num_of_pl - all ultimately the unvalidated VBIOS u8 count (up to 255). Measured on the guest with the exact format strings: 255 PP_PCIE lines = 4481 bytes and 255 PP_SCLK lines with u32-scale clocks = 4481 bytes, both overflowing PAGE_SIZE; the per-line reads dpm_levels[i] for i >= 8 are themselves OOB reads of the dpm_levels[8] arrays. Impact: heap overflow of the kernfs page on an UNPRIVILEGED sysfs read once the count is corrupted by a crafted VBIOS; ~385 bytes past the page.",
  "exploit_chain": "",
  "evidence": "run.log: PP_SCLK count=255, u32 clocks -> 4481 bytes OVERFLOWS PAGE_SIZE(4096), PP_PCIE count=255 -> 4481 bytes OVERFLOWS PAGE_SIZE(4096); VERDICT.md; fix.diff",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:4428",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:4444",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:4458",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:4468",
    "sys/dev/drm/amd/amdgpu/amdgpu_pm.c:650"
  ],
  "poc_changes": "No seed; wrote a budget harness replaying the exact format strings with measured line lengths (compile at -O0; -O2 sees the UB in the index math and misoptimizes unrelated accounting).",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 90,
  "guest_dirty": 0,
  "build_cmd": "cc -Wall -O0 -o t sprintf_budget.c (DragonFly 6.5 base cc, on guest)",
  "run_cmd": "cd /tmp/DF-3688 && ./t",
  "code_hash": "349e0401f40fee513bbe9f7bb746403fe3020d11590471324f94c76b9230551b",
  "notes": "Guest virtio-only (no AMD GPU: pciconf shows only QEMU 0x1237/0x1111; amdgpu.ko/drm.ko present in /boot/kernel but unloaded). Harness proves the primitive/arithmetic with verbatim kernel code shape and 1:1 struct layouts; the in-kernel trigger needs an SMU7 ASIC + crafted VBIOS / VFIO / root pp_table write. Compiled -O0: -O2 detects the index UB and misoptimizes the accounting.",
  "recommended_fix": "Cap every print loop at MAX_REGULAR_DPM_NUMBER (the dpm_levels array bound) and at the odn entries bound; the root count validation is DF-1166s fix.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree after source+harness verification; not built (no AMD hardware on guest).",
  "fix_evidence": "findings/poc/DF-3688/fix.diff"
}