# DF-3701 runtime on audit guest (vm.sh run_root, read-only probes; /tmp artifacts removed)
[hardware gate]
pciconf -l | grep -c 1002            -> 0        (no AMD device; QEMU std VGA 0x1234:0x1111)
/boot/kernel/amdgpu.ko               -> present (124519320 bytes)
dmesg                                -> "[drm] amdgpu kernel modesetting enabled."
kernel source in guest               -> /usr/src/sys/.../vega10_hwmgr.c identical (162075 bytes)
guest src excerpt :4186-4190 (the unbounded loop, confirmed on the guest's kernel source):
	for (i = 0; i < dep_table->count; i++) {
		clocks->data[i].clocks_in_khz = dep_table->entries[i].clk * 10;
		clocks->data[i].latency_in_us = 0;
		clocks->num_levels++;
	}
[userspace stand-in of the loop math, compiled+run on guest with base cc 8.3]
simulated writes=16777232 OOB-beyond-data[16]=2 -> kernel stack frame smashed
on real Vega10 hw: kernel stack overflow at driver/DC init (crafted VBIOS)
this guest: virtio-only, 0 AMD PCI devices, amdgpu never binds -> inconclusive
NOTE: the stand-in's own loop counter (dep_count) was overwritten by the OOB
writes during the run (final value 0x1000018 = a clocks_in_khz value) — the
corruption of stack-adjacent locals is demonstrated live, in userspace.
[verdict] kernel path cannot execute on this guest -> status=inconclusive,
impact not demonstrated at runtime; defect is source-certain (see VERDICT.md).