{
  "finding_id": "DF-3858",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Source-traced dual defect in vega20_get_sclk_od/vega20_get_mclk_od (vega20_hwmgr.c:1318-1381), the DF-3686/DF-3707 twins: (A) DIV_ROUND_UP(value*100, golden_value) at :1332/:1378 divides by zero when the golden top clock is 0 - reachable with the DPM_GFXCLK/DPM_UCLK SMU feature disabled, where setup_gfxclk/memclk_dpm_table seeds dpm_levels[0].value from the raw VBIOS bootup_sclk/mclk_in10khz copied with no zero check (ppatomfwctrl.c:523/:556 -> vega20_hwmgr.c:745-746, :546/:567, golden copy at :714); (B) dpm_levels[count-1] with count==0 wraps to 0xFFFFFFFF - a wild read 34,359,738,360 bytes (~32 GiB) past dpm_levels[0] in the kzallocd vega20_hwmgr backend - reachable after a failed SMU re-enable on resume (hwmgr.c:308-330 has no cleanup, pm_en stays set from amd_powerplay.c:51) with the sysfs node still dispatching. Trigger is the world-readable sysfs pp_sclk_od/pp_mclk_od (S_IRUGO, amdgpu_pm.c:1019-1022 -> pp_dpm_get_sclk_od amd_powerplay.c:757, only !hwmgr||!pm_en guard). Guest evidence: case A traps SIGFPE (exit=136, signal 8 = the kernel #DE class) 3/3 runs; case Bs verbatim access with rax=0xFFFFFFFF confirmed in guest objdump (mov 0x401ef8(,%rax,8),%ecx) computing the +34 GiB address. Kernel reach not reproducible here: 0 AMD PCI devices, no /dev/dri (env.txt). Distinct from known DF-1253 (the apply_clocks_adjust_rules mclk_latency_table loop), DF-1254 (OD8 arrays), DF-1255 (setup_single_dpm_table write). Impact ceiling on Vega20 hardware in the affected states: unprivileged local DoS via panic + wild OOB read.",
  "exploit_chain": "unprivileged local user: cat /sys/class/drm/card0/device/pp_sclk_od -> amdgpu_get_pp_sclk_od (amdgpu_pm.c:794) -> pp_dpm_get_sclk_od (amd_powerplay.c:757) -> vega20_get_sclk_od -> (A) DIV_ROUND_UP by golden_value==0 -> #DE panic, or (B) dpm_levels[0xFFFFFFFF] wild read at +34.4 GB -> page fault/panic or garbage into the divide. Preconditions: (A) VBIOS bootup_sclk_in10khz==0 with DPM_GFXCLK disabled; (B) failed SMU re-enable on resume leaving memset-zero dpm tables.",
  "evidence": "run.log (case A SIGFPE exit=136 x2, case B index/offset printout); run.2.log (3rd trap + dmesg exited on signal 8 + objdump of the verbatim wild load); VERDICT.md (full chain incl. resume-path reachability correction and killed profiling-mask variants); fix.diff (git-apply-clean); env.txt (no AMD ASIC)",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:1326",
    "sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:1332",
    "sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:1372",
    "sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:1378",
    "sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:546",
    "sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:567",
    "sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:745",
    "sys/dev/drm/amd/powerplay/hwmgr/ppatomfwctrl.c:523",
    "sys/dev/drm/amd/powerplay/hwmgr/ppatomfwctrl.c:556",
    "sys/dev/drm/amd/powerplay/hwmgr/hwmgr.c:308",
    "sys/dev/drm/amd/powerplay/amd_powerplay.c:51",
    "sys/dev/drm/amd/powerplay/amd_powerplay.c:757",
    "sys/dev/drm/amd/amdgpu/amdgpu_pm.c:1019"
  ],
  "poc_changes": "Authored from scratch. One build fix: missing <stdbool.h> for the struct replica (guest cc 8.3).",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 200,
  "guest_dirty": 0,
  "build_cmd": "vm.sh run_root cc -O2 -Wall -o /tmp/od_div0 /tmp/od_div0.c",
  "run_cmd": "vm.sh run_root /tmp/od_div0 0; /tmp/od_div0 1 (plus objdump + dmesg probes; /tmp cleaned)",
  "code_hash": "34ee6096eb4ecba3dfd207e3288e83bdc5adf2a0e7d33c8487d630d907de7004",
  "notes": "Pass-2 checklist item (c) for vega20 (DF-3686/3707 twins). The profiling-mask count-1 sites (:2229-2231) and force_clock_level were traced safe. Clock getters (item a) are clamped at :2405/:2434/:2460/:2483 to MAX_NUM_CLOCKS with mclk_latency_table.entries[16] - negative. print_clock_levels/get_power_profile_mode page overflow (item e) computed <3KB - negative. vddInd lookups (item f) absent from vega20 - negative. NULL-pptable (item b) killed by hwmgr_hw_init order (hwmgr.c:207-256). set_power_profile_mode input[size] (item g) fed by amdgpu_pm.c parameter[parameter_size]=profile_mode - in-bounds by design.",
  "recommended_fix": "Guard vega20_get_sclk_od/get_mclk_od: return 0 when either table count is 0 or the golden top value is 0 (and zero-floor the VBIOS boot-up clocks in vega20_init_smc_table)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff adds the count/golden-value guards to both OD getters and is git-apply-clean against the read-only sys/ tree; no Vega20 ASIC on this guest (amdgpu never binds), so a patched-kernel run cannot be exercised - not_testable",
  "fix_evidence": "fix.diff; VERDICT.md; env.txt"
}