# DF-3890 — `vid_mapping_table->entries[num_entries - 1]` with `num_entries == 0` → wild read (~+16 GB) in `kv_convert_vid2_to_vid7`

**File:** `sys/dev/drm/amd/amdgpu/kv_dpm.c:90` (primary sink; identical pattern at `:114` in `kv_convert_vid7_to_vid2`)
**Class:** CWE-191 unsigned count-1 underflow → wild OOB read (boot-time panic)
**Verdict:** `inconclusive` at runtime on this guest (no AMD GPU); **source-certain**; harness proves index/offset and SIGSEGV on the verbatim read.

## Build (on the DragonFly guest, as root)

    mkdir -p /tmp/DF-3890 && cp vid_mapping_zero_entries.c /tmp/DF-3890/h.c
    cd /tmp/DF-3890 && cc -Wall -O0 -o t h.c

## Run

    ./t          # accounting — index and byte offset
    ./t crash    # verbatim read -> SIGSEGV (exit 139)

## Expected

- accounting: `num_entries = 0`; `entries[4294967295]`; byte offset
  `4294967295 * 4 = 17179869180` (~17.2 GB) past the 16-byte array.
- crash: `Segmentation fault`, exit=139 (kernel equivalent: page fault in kernel
  mode → panic).

## Kernel trigger (all VBIOS-controlled, parse-legal)

1. `sAvail_SCLK[]` has strictly-increasing nonzero `ulSupportedSCLK` (so
   `num_max_dpm_entries > 0` and the guard at kv_dpm.c:2040 passes) but
   `usVoltageID == 0` on every entry → `sumo_construct_vid_mapping_table` leaves
   every `vid_7bit` zero → compaction breaks at `i == 0` → `num_entries = 0`
   (kv_dpm.c:185-190).
2. PowerPlayInfo has no VddcDependencyOnSCLK subtable (`count == 0`) → the else
   branch at kv_dpm.c:86-91 is taken.

Boot path: `kv_dpm_init` → `kv_parse_sys_info_table` (:2617) →
`kv_construct_max_power_limits_table` (:2045) → `kv_convert_2bit_index_to_voltage`
(:690) → `kv_convert_vid2_to_vid7` (:90). Also reached later from
`kv_init_graphics_levels` (:2453) in the same `count == 0` configuration.