{ "finding_id": "DF-3856", "status": "inconclusive", "reproduced": 0, "impact": "none", "confidence": "certain", "verdict": "Source-certain undefined behavior: four combios parser sites use an unchecked BIOS byte as a 32-bit shift count. combios_parse_pll_table() case 1 computes shift = RBIOS8(offset)*8 (0..2040) and shifts with it (radeon_combios.c:3103-3108), feeding WREG32_PLL a value masked with a garbage-derived and/or mask pair at driver init/resume from the PLL INIT / DYN CLK tables (radeon_combios.c:3329-3340, 3407-3410). Voltage-GPIO masks (1 << tmp) at :2752/:2760 (consumed by the r100_pm_misc RMW - see DF-3852), i2c gpiopad masks (1 << clk)/(1 << data) at :654-658, and thermal-controller masks (1 << clk_bit) at :2687 share the defect. C99 6.5.7p3 makes counts >= 32 UB. Harness demonstrates the concrete misbehaviour on the audit toolchain (DragonFly cc 8.3, x86-64): counts silently taken mod 32 - pll case 1 with shift byte 4 yields and_mask 0xffffff0f (byte lane 0) where lane 3 (0x0fffffff) was programmed; 1<<32 gives bit 0; 1<<200 gives bit 8 - wrong PLL/GPIO programming with no trap and no runtime warning. Kernel-side write sinks hardware-gated (no radeon device on guest). Low severity standalone; force-multiplier for the MMIO-injection findings.", "exploit_chain": "crafted or bit-flipped VBIOS -> shift byte >= 4 (pll table) or >= 32 (mask sites) -> UB shifts silently mis-build the mask pair -> WREG32_PLL / r100_pm_misc / GPIO set_masks write wrongly-masked values -> GPU clock/GPIO misprogramming (hang / failed posting)", "evidence": "run.log decisive lines: [pll case1] shift_byte=4 -> shift=32: and_mask=0xffffff0f (UB! count taken mod 32 -> lane 0 ... expected 0x0fffffff), [gpio mask] tmp=32 -> 1< 1<