# DF-3706 — vega10_setup_default_pcie_table reads bios entries[1] when the VBIOS PCIE table has a single state (NUM_LINK_LEVELS=2)

File: sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c (pass 2).

## Bug (:1228-1252)
	PP_ASSERT_WITH_CODE(bios_pcie_table->count,            // :1228 — only checks != 0
			"Incorrect number of PCIE States from VBIOS!", return -1);

	for (i = 0; i < NUM_LINK_LEVELS; i++) {                // :1232 — NUM_LINK_LEVELS == 2
		... pcie_table->pcie_gen[i]  = bios_pcie_table->entries[i].gen_speed;   // :1238
		... pcie_table->pcie_lane[i] = encode_pcie_lane_width(
					bios_pcie_table->entries[i].lane_width);                  // :1244-1245
		... pcie_table->lclk[i]      = bios_pcie_table->entries[i].pcie_sclk;  // :1251

The parser (get_pcie_table, vega10_processpptables.c:757-790) allocates exactly
`ucNumEntries` records and the assert above accepts any nonzero count — a VBIOS PCIE table
with ucNumEntries == 1 leaves `entries[1]` beyond the allocation, and :1238/:1244/:1251
read it (heap OOB read). The garbage gen/lane/lclk values are then installed as
pcie_table->[1] and uploaded to the SMC (vega10_populate_smc_link_levels :1480-1504, count
forced to NUM_LINK_LEVELS at :1254).

## Trigger (requires AMD Vega10 hardware)
VBIOS powerplay table with ATOM_Vega10_PCIE_Table.ucNumEntries == 1 (but nonzero). Driver
load → vega10_enable_dpm_tasks → vega10_init_smc_table :2472 → vega10_setup_default_dpm_tables
:1415 → this function → OOB read of one phm_ppt_v1_pcie_record.

## Impact
Heap OOB read feeding wrong PCIe gen/lane/clock to the SMC link state (hardware misprogram /
info exposure into SMC uploads); adjacent-allocation read is not attacker-directed content,
so this is a Medium/Low correctness+OOB-read defect rather than a corruption primitive.

## PoC status
Guest virtio-only → inconclusive, source-certain.