{
  "finding_id": "DF-3701",
  "title": "vega10 clock getters overflow caller's 16-entry stack array (unbounded VBIOS dep-table counts)",
  "verdict": "inconclusive",
  "impact": "source-certain kernel stack overflow; not demonstrable on virtio-only guest",
  "reproduce": {
    "build": "guest: cc -Wall -o /tmp/df3701 /tmp/df3701.c  (stand-in loop-math demo; DF base cc 8.3)",
    "run": "guest: /tmp/df3701  (plus pciconf/dmesg hardware-gate probes in run.log)",
    "expected": "stand-in shows its own stack-adjacent loop counter overwritten by the OOB writes; real kernel path requires Vega10 hw + crafted VBIOS (absent on guest)"
  },
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:4115",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:4135",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:4161",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:4177",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:4217",
    "sys/dev/drm/amd/display/amdgpu_dm/amdgpu_dm_pp_smu.c:375",
    "sys/dev/drm/amd/include/dm_pp_interface.h:28",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:540"
  ],
  "artifacts": ["README.md","VERDICT.md","trigger_shape.c","build.sh","run.sh","build.log","run.log","guest_build_run.log","env.txt","fix.diff","manifest.json","verdict.json"]
}