# DF-3704 VERDICT — odn_edit negative index wild write

**status: inconclusive (hardware-gated) — source-certain. reproduced=0 on audit guest.**

## Proof chain (lines verified in guest /usr/src, see run.log)
1. amdgpu_pm.c:552 `long parameter[64];` :584 `kstrtol(sub_str, 0, &parameter[parameter_size])`
   — signed 64-bit parse; "s -1 1600 1150" yields parameter[0] = -1.
2. vega10_hwmgr.c:4884 `input[i] >= podn_vdd_dep_table->count` — long vs (int-promoted)
   uint8_t count: signed comparison; -1 < count → guard passes.
3. :4888 `input_level = input[i];` — uint32_t truncation of the negative long → 0xFFFFFFFF.
4. :4893-4895 index `dpm_table->dpm_levels[input_level]` (dpm_levels[8]) and
   `podn_vdd_dep_table->entries[input_level]` (entries[8]) with 0xFFFFFFFF → byte offsets
   ~0xFFFFFFFF*8/12 (~34GB) from the arrays → wild kernel write of user value
   (`input_clk`/`input_vol` fully controlled 32-bit values).
   Any negative value in [-2^31, -1] truncates to a large uint32; values below -2^31
   truncate to smaller/large uint32s equally unchecked.

Impact: privileged (root sysfs S_IWUSR) kernel arbitrary-offset write → memory corruption;
on a system where the sysfs node is writable by a lesser-privileged service or via a confused
deputy this is an escalation primitive. As shipped: root → kernel corruption (usually a
crash, potentially worse on unhardened configs). Severity Medium (privileged trigger).

## Guest result
0 AMD PCI devices; amdgpu.ko never binds; `pp_od_clock_voltage` never exists on this guest.
The parser (amdgpu_pm.c) accepts negative tokens — verified at source; the sink lines are
confirmed in the guest's kernel source (run.log). Verdict: inconclusive, source-certain.

## Fix
fix.diff adds an explicit negative check (and documents the correct unsigned compare):
`if (i + 3 > size || input[i] < 0 || input[i] >= podn_vdd_dep_table->count)`.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.