# DF-3703 VERDICT — ODN entries[8] overflows from unbounded dep-table counts

**status: inconclusive (hardware-gated) — source-certain. reproduced=0 on audit guest.**

## Proof chain (lines verified in guest /usr/src, see run.log)
1. Destination capacity is hard-fixed at 8:
   vega10_hwmgr.h:285/:290 `entries[MAX_REGULAR_DPM_NUMBER]`, MAX_REGULAR_DPM_NUMBER=8
   (vega10_hwmgr.h:122); odn_dpm_table embedded in struct vega10_hwmgr (:314+) — one kzalloc.
2. Source counts are untrusted and unbounded:
   vega10_processpptables.c get_{socclk,mclk,gfxclk}_voltage_dependency_table set
   `count = (uint32_t)ucNumEntries` (uint8 <= 255) with matching allocations (no SMC-level cap).
3. Copies ignore the mismatch:
   - smu_helper.c:684-695 `smu_get_voltage_dependency_table_ppt_v1` loop `for (i=0;i<dep_table->count;i++)`
     writes dep_table->entries[i] — invoked from vega10_hwmgr.c:322-323 with od_table[i] =
     fixed entries[8] destinations. count=255 => ~247 x 44-byte records written over
     odn_dpm_table's siblings and beyond within/past the vega10_hwmgr allocation.
   - vega10_hwmgr.c:310-311 (vddc lookup copy, amplifier when lookup count>8),
     :2432/:2441 (OOB reads in check_dpm_table_updated),
     :4821-4828 (OOB writes in odn_update_soc_table: podn_vdd_dep_on_socclk->entries[i] and
     dpm_table->dpm_levels[i] for i < socclk dep count).
4. Reachability: vega10_init_smc_table:2478-2484 (od_enabled at init) and root sysfs
   pp_od_clock_voltage 'r'/:4874, 'c'/:4877, edits/:4900 (amdgpu_pm.c:543-602 parser feeds
   long parameter[] straight into odn_edit_dpm_table).

Impact: kernel heap overflow with attacker-controlled record contents (clk in 10kHz units,
voltage, indices) => corruption of adjacent vega10_hwmgr state and heap neighbors; on a
hardened box a crash, on default deployments a potential privesc primitive (no KASLR/SMEP/SMAP
by default). Severity High for the crafted-VBIOS threat model.

## Guest result
0 AMD PCI devices; amdgpu.ko never binds; the path cannot execute. Cited lines confirmed in
guest /usr/src (run.log). Verdict: inconclusive, source-certain.

## Fix
fix.diff bounds every copy/read by the destination capacity (min(count, MAX_REGULAR_DPM_NUMBER)),
and caps vega10_odn_update_soc_table's soc loop at MAX_REGULAR_DPM_NUMBER.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.