{
  "finding_id": "DF-3704",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain wild kernel write (DF-3687 smu7 twin): vega10_odn_edit_dpm_table:4884 compares signed long user input against uint8_t count, so negative tokens (parsed by kstrtol at amdgpu_pm.c:584) pass the guard; input_level=(uint32_t)negative (:4888) then indexes dpm_levels[8]/entries[8] at :4893-4895 with ~0xFFFFFFFF, writing user-chosen 32-bit values ~34GB off the arrays. Trigger is root-only sysfs pp_od_clock_voltage on a Vega10 with OD enabled \u2014 node absent and amdgpu unbound on the virtio-only audit guest (0 AMD PCI devices), so no runtime repro; sink lines verified in guest /usr/src.",
  "exploit_chain": "root echo s -1 <clk> <mv> > pp_od_clock_voltage -> entries[(uint32_t)-1] write with controlled value -> kernel memory corruption (privileged; crash-to-RCE on unhardened configs)",
  "evidence": "VERDICT.md proof chain; run.log (guest-src excerpt :4883-4895); trigger_notes.c (type-confusion demo); fix.diff",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:4884",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:4893",
    "sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c:4895",
    "sys/dev/drm/amd/amdgpu/amdgpu_pm.c:584"
  ],
  "poc_changes": "no runnable PoC possible (hardware-gated); documented exact sysfs string and the signed/unsigned semantics",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 30,
  "guest_dirty": 0,
  "build_cmd": "n/a (sysfs trigger)",
  "run_cmd": "n/a on guest (no AMD hw)",
  "code_hash": "347eb41052a91238e895c88d48850a95b64efbfe5ab2f75c0209eba6e6f319ca",
  "notes": "smu7 checklist item (e). Root-gated, hence Medium.",
  "recommended_fix": "Reject negative input before the count compare: input[i] < 0 || input[i] >= count (fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against read-only sys/ tree; no AMD hw on guest so no patched-kernel validation possible",
  "fix_evidence": "fix.diff; run.log hardware gate"
}