# DF-3705 — vega10 SMC PPTable populate loops write 8-entry SMC arrays with unbounded VBIOS dep-table counts (heap OOB writes)

File: sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c (pass 2). smu7 checklist item (h): SMC-table upload level caps.

## Sinks (destination arrays are all size 8 inside `PPTable_t pp_table` in the kzalloc'd
`struct vega10_hwmgr`; the only bound is the VBIOS `ucNumEntries` count, <=255):
1. vega10_populate_clock_stretcher_table :2060-2064 —
   `pp_table->CksEnable[i]` / `CksVidOffset[i]` for i < vdd_dep_on_sclk->count
   (CksEnable[8]/CksVidOffset[8], smu9_driver_if.h:229-230). Attacker byte = cks_enable /
   scaled cks_voffset.
2. vega10_populate_avfs_parameters :2143-2145 — `StaticVoltageOffsetVid[i]` for i <
   vdd_dep_on_sclk->count (StaticVoltageOffsetVid[8], smu9_driver_if.h:294).
3. vega10_populate_smc_uvd_levels :2030-2045 — `UvdDpmVoltageIndex[i]` (8, :187) for i <
   mm_dep_table->count; the same loop also READS `vclk/dclk_dpm_table->dpm_levels[i]`
   (dpm_levels[8]) for i < mm count → OOB read; :2043 pads from entries[count-1].
4. vega10_populate_vddc_soc_levels :1700-1708 — `SocVid[i]` (SocVid[NUM_EVV_VOLTAGE_LEVELS=8],
   smu9_driver_if.h:167) for i < vddc_lookup_table->count (amplifier: requires lookup count>8,
   which the get_vddc_lookup_table anomaly (vega10_processpptables.c:1032 stores
   count=ucNumEntries into an 8-entry alloc) can produce).

## Contrast (the correct pattern already in this file)
vega10_populate_single_display_type :1850-1852 guards with
`PP_ASSERT_WITH_CODE(dep_table->count <= NUM_DSPCLK_LEVELS, ...)` before its loop — the four
sinks above lack exactly this guard.

## Trigger (requires AMD Vega10 hardware)
Craft VBIOS: GFXCLK dependency ucNumEntries=32 with cks fields set (clock stretcher enabled via
feature mask), or MM dependency ucNumEntries=16. Driver enable_dpm_tasks (:2911-2919) →
vega10_init_smc_table (:2550-2554 clock stretcher; :2545 uvd) writes up to 255 bytes past
CksEnable[8]/UvdDpmVoltageIndex[8] into the following PPTable_t fields (SMC upload block) and
beyond within struct vega10_hwmgr.

## PoC status
Guest virtio-only → inconclusive, source-certain.