# VERDICT — DF-3741

**Status**: inconclusive (source-certain; harness-reproduced arithmetic; kernel path unreachable on this guest)
**reproduced**: 0 (in-kernel) — harness demonstration: YES
**Impact on real hardware**: Medium — CWE-835 Loop with Unreachable Exit Condition

## Finding
Two BIOS-gated infinite loops (kernel hang at driver init / first DPM use): (1) radeon_atom_init_mc_reg_table():4023-4045 walks reg_data in usRegDataBlkSize strides; with a BIOS stride of 0 and mem-id mismatch, neither the END sentinel nor the num_ranges<VBIOS_MAX_AC_TIMING_ENTRIES cap can ever trigger — non-terminating loop; with a nonzero stride the walk scans unbounded past the VBIOS image heap until it stumbles on 0xFFFFFFFF (OOB read). (2) atom_lookup_voltage_object_v3():3423-3429 advances by the object's self-declared usSize; usSize==0 with a type/mode mismatch never advances — non-terminating. Harness on guest: both replicas fail to terminate within 2^24 iterations (the cap exists only in the harness); a stride-4 control with an END marker terminates in 3. Same source certainty as pass-1 class but distinct functions; no AMD hardware on this guest.

## Why not reproduced in-kernel
The QEMU guest is virtio-only (no AMD GPU): `pciconf -l` shows no 1002 device;
`kldstat` shows radeon not loaded. `/boot/kernel/radeon.ko` exists (the vulnerable code ships in
the default install) but cannot attach, so radeon_atombios.c parse paths never execute here.
All conclusions are source-level (path:line above) plus the on-guest harness (harness_hang.c).

## Harness result
Command: ./run.sh (after ./build.sh)
Expected/observed: both zero-stride walks hit the 2^24-iteration harness cap (non-termination); control terminates in 3; exit_code=0
Full logs: build.log, run.log.

## Impact / exploit chain
crafted VBIOS (VRAM_Info frev2/crev1 with usRegDataBlkSize=0, or VoltageObjectInfo v3 object with usSize=0) -> kldload/boot hangs the kernel in a tight loop -> local DoS (requires VBIOS control)

## Fix
reject zero strides — fix.diff.

## Honest notes
- DF-3741 does NOT re-report pass-1 findings DF-1198/1199/1200 (power-table state_index mismatch,
  asic_ss_info underflow, power-table indices) — different functions/tables/fields.
- fix validation not possible on this guest (no hardware); fix.diff is source-authored only.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.