# DF-3705 VERDICT — SMC populate level-cap overflows

**status: inconclusive (hardware-gated) — source-certain. reproduced=0 on audit guest.**

## Proof chain (lines verified in guest /usr/src, see run.log)
1. Destinations: smu9_driver_if.h:167 SocVid[8], :229-230 CksEnable[8]/CksVidOffset[8],
   :294 StaticVoltageOffsetVid[8], :187 UvdDpmVoltageIndex[8] — all inside
   `PPTable_t pp_table` = `data->smc_state_table.pp_table`, embedded in the kzalloc'd
   struct vega10_hwmgr.
2. Sources: vdd_dep_on_sclk / mm_dep_table counts = raw ATOM ucNumEntries (<=255), allocated
   to match (vega10_processpptables.c:540/:313) — unbounded w.r.t. the 8-entry SMC arrays.
3. Loops with no cap:
   - vega10_hwmgr.c:2060-2064 (CksEnable/CksVidOffset, dep_on_sclk count)
   - :2143-2145 (StaticVoltageOffsetVid, dep_on_sclk count)
   - :2030-2045 (UvdDpmVoltageIndex writes; vclk/dclk dpm_levels[8] reads; mm count)
   - :1700-1708 (SocVid, vddc_lookup_table->count; >8 via the lookup-parse anomaly)
   The one guarded twin (:1850-1852 NUM_DSPCLK_LEVELS assert) proves the intended pattern.
4. Reach: vega10_enable_dpm_tasks :2911-2919 → vega10_init_smc_table :2545/:2550-2554/:2533
   → the four sinks, at driver load / resume on the crafted-VBIOS card.

Impact: attacker-influenced byte writes (cks_enable/cks_voffset-derived/sclk_offset-derived/
vddcInd-derived VID bytes) at monotonically increasing offsets past 8-entry arrays into the
SMC upload block and adjacent vega10_hwmgr state; count 255 → up to ~247 bytes per sink,
three sinks chainable in one init. Heap corruption → crash or worse on unhardened configs.
Severity High under the crafted-VBIOS threat model.

## Guest result
0 AMD PCI devices; amdgpu.ko never binds. Sink loops + array defs confirmed in guest /usr/src
(run.log). Verdict: inconclusive, source-certain.

## Fix
fix.diff adds the missing `count <= ARRAY_SIZE` asserts (returning -EINVAL) exactly
mirroring :1850-1852 for the four sinks.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.