{
  "finding_id": "DF-3888",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain unsigned count-1 underflow (DF-3686/DF-3858 family, legacy-DPM twin); runtime-inconclusive on this guest (no AMD GPU). kv_parse_power_table only sets ps->num_levels for valid clock entries (kv_dpm.c:2694, loop :2756-2769 with continue at :2758-2759), so a VBIOS state with ucNumDPMLevels==0 or all-invalid clockInfoIndex[] leaves num_levels==0 from kzalloc. kv_dpm_get_sclk (:2938) then reads levels[num_levels-1] = levels[0xFFFFFFFF] = levels + 51,539,607,540 bytes (~48 GB) - a wild kernel read -> page fault -> panic; reachable UNPRIVILEGED on such a machine via the AMDGPU_INFO ioctl AMDGPU_INFO_DEV_INFO (amdgpu_kms.c:700, DRM_AUTH|DRM_RENDER_ALLOW) and every DCE8 modeset (dce_v8_0.c:971). Same underflow at kv_set_valid_clock_range :1791/:1817 on the first transition to such a state. Harness prints index 4294967295 / offset 51539607540 and crash mode SIGSEGVs on the verbatim read (kernel equivalent: panic).",
  "exploit_chain": "crafted-VBIOS state with 0 valid clock levels becomes requested_ps -> unprivileged AMDGPU_INFO ioctl -> amdgpu_dpm_get_sclk(false) -> kv_dpm_get_sclk reads levels[0xFFFFFFFF] (+48 GB) -> kernel page fault -> panic (DoS). Wild-read value is not exfiltrable (offset unmapped).",
  "evidence": "run.log: num_levels = 0, levels[4294967295], levels + 51539607540 bytes (~51.5 GB); run.2.log: crash mode Segmentation fault exit=139; VERDICT.md; fix.diff",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/kv_dpm.c:2938",
    "sys/dev/drm/amd/amdgpu/kv_dpm.c:1791",
    "sys/dev/drm/amd/amdgpu/kv_dpm.c:1817",
    "sys/dev/drm/amd/amdgpu/kv_dpm.c:2694",
    "sys/dev/drm/amd/amdgpu/amdgpu_kms.c:700"
  ],
  "poc_changes": "No seed (pass-2 self-authored); single guest build+run cycle succeeded.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "cd /tmp/DF-3888 && cc -Wall -O0 -o t h.c",
  "run_cmd": "cd /tmp/DF-3888 && ./t && ./t crash",
  "code_hash": "2960743331009d8053e35fa945ed57dbf9db8336e74c5c4a19d89e465be8754f",
  "notes": "Guest virtio-only (no AMD GPU). VBIOS precondition gates the unprivileged ioctl trigger, so the primitive is recorded AV:P-consistent with DF-1269/DF-3586 precedent; the panic is certain once such a state exists. Not a re-report of DF-1269 (that covers kv_parse_power_table OOB reads of the BIOS image itself, not the levels[] underflow at use sites).",
  "recommended_fix": "Guard num_levels==0 (and NULL ps_priv) in kv_dpm_get_sclk (kv_dpm.c:2935) and early-return in kv_set_valid_clock_range (:1781).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree after source+harness verification; not built (no AMD hardware on guest).",
  "fix_evidence": "findings/poc/DF-3888/fix.diff"
}