# DF-3706 VERDICT — pcie bios entries[1] OOB read

**status: inconclusive (hardware-gated) — source-certain. reproduced=0 on audit guest.**

## Proof chain (lines verified in guest /usr/src, see run.log)
1. smu9_driver_if.h:44 `#define NUM_LINK_LEVELS 2`.
2. vega10_processpptables.c:772-783 get_pcie_table kzallocs `ucNumEntries` records; the count
   is the raw ATOM value (1..255), no minimum of NUM_LINK_LEVELS enforced.
3. vega10_hwmgr.c:1228 asserts only `bios_pcie_table->count != 0`; :1232-1252 then reads
   `bios_pcie_table->entries[i]` for i in [0, NUM_LINK_LEVELS) — with count == 1 the read of
   entries[1] is past the kzalloc'd table (heap OOB read), and its garbage is committed to
   pcie_table->pcie_gen/lane/lclk[1] (:1254 count = NUM_LINK_LEVELS) and uploaded to the SMC
   by vega10_populate_smc_link_levels (:1480-1504).

Impact: OOB heap read + wrong PCIe link programming on crafted/malformed VBIOS. DoS-adjacent
and correctness; Medium/Low. (Upstream Linux later clamped this loop to bios count and let
populate_smc_link_levels pad.)

## Guest result
0 AMD PCI devices; amdgpu.ko never binds. Lines confirmed in guest /usr/src (run.log).
Verdict: inconclusive, source-certain.

## Fix
fix.diff clamps the loop to min(NUM_LINK_LEVELS, bios count) and lets the established
padding path in vega10_populate_smc_link_levels (:1492-1504) replicate the last valid level.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.