{
 "finding_id": "DF-3859",
 "title": "vega20_odn_edit_dpm_table VDDC_CURVE: signed one-sided bounds check lets negative user index through -> OOB read of od8_settings_array disclosed via pr_info (DF-3704 twin)",
 "verdict": "not_reproduced (kernel reach hardware-gated; OOB read + leak semantics demonstrated verbatim on guest heap stand-in)",
 "impact_ceiling": "root/confused-deputy kernel-heap info leak to dmesg + attacker-magnitude wild read (panic); no write primitive",
 "reproduce": {
  "build": "vm.sh run_root 'cc -O2 -Wall -o /tmp/odn_negidx /tmp/odn_negidx.c'",
  "run": "vm.sh run_root '/tmp/odn_negidx 1 1000; /tmp/odn_negidx -2 1000; /tmp/odn_negidx -7 1000'",
  "expected": "control od8_id=4 in-bounds; attacks print od8_id=-2/-12 with OOB marker bytes (-1515870811) in the range message"
 },
 "kernel_refs": [
  "sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:2678",
  "sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:2685",
  "sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:2686",
  "sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:2695",
  "sys/dev/drm/amd/amdgpu/amdgpu_pm.c:1028"
 ],
 "artifacts": [
  "README.md",
  "VERDICT.md",
  "odn_negidx.c",
  "build.sh",
  "run.sh",
  "run.log",
  "env.txt",
  "fix.diff",
  "verdict.json",
  "manifest.json"
 ],
 "code_hash": "9a49584e120a505b733cb8fc0a10a726f9377537d7507e0272d3019d7d7cf640"
}