{
  "finding_id": "DF-3890",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain count-1 underflow wild read; runtime-inconclusive on this guest (no AMD GPU). kv_convert_vid2_to_vid7 (kv_dpm.c:90) returns vid_mapping_table->entries[num_entries - 1].vid_7bit when no entry matches; num_entries comes from sumo_construct_vid_mapping_table (:185-190) and is legitimately 0 when every VBIOS sAvail_SCLK usVoltageID == 0 (while nonzero strictly-increasing ulSupportedSCLK keeps num_max_dpm_entries > 0 so the :2040 guard passes). With vddc_dependency_on_sclk.count == 0 (no SCLK dep subtable, amdgpu_dpm.c:384-395), the else branch runs at boot: kv_dpm_init -> kv_parse_sys_info_table (:2617) -> kv_construct_max_power_limits_table (:2045) -> kv_convert_2bit_index_to_voltage (:690) -> entries[0xFFFFFFFF] = +17,179,869,180 bytes (~16 GiB) -> page fault -> panic. Identical latent pattern at :114. Harness prints index/offset and crash mode SIGSEGVs on the verbatim read. Distinct from DF-3887 (write with out-of-range index) and DF-1268/1269.",
  "exploit_chain": "crafted VBIOS (nonzero increasing sAvail_SCLK SCLKs, all usVoltageID=0, no SCLK dep subtable) -> boot -> kv_parse_sys_info_table -> kv_convert_2bit_index_to_voltage -> kv_convert_vid2_to_vid7 wild read +16 GiB -> kernel page fault -> panic (boot-time DoS).",
  "evidence": "run.log: num_entries = 0, entries[4294967295], +17179869180 bytes (~17.2 GB); run.2.log: crash mode Segmentation fault exit=139; VERDICT.md; fix.diff",
  "kernel_refs": [
    "sys/dev/drm/amd/amdgpu/kv_dpm.c:90",
    "sys/dev/drm/amd/amdgpu/kv_dpm.c:114",
    "sys/dev/drm/amd/amdgpu/kv_dpm.c:190",
    "sys/dev/drm/amd/amdgpu/kv_dpm.c:2045",
    "sys/dev/drm/amd/amdgpu/amdgpu_dpm.c:384"
  ],
  "poc_changes": "No seed (pass-2 self-authored); single guest build+run cycle succeeded.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 45,
  "guest_dirty": 0,
  "build_cmd": "cd /tmp/DF-3890 && cc -Wall -O0 -o t h.c",
  "run_cmd": "cd /tmp/DF-3890 && ./t && ./t crash",
  "code_hash": "bf4edfe62889b39b8b36cc9a23863812987ccb66f78f83626426d1a6092625ad",
  "notes": "Guest virtio-only (no AMD GPU). Deeper VBIOS precondition than DF-3887/3888 (needs two coordinated table quirks), hence Low severity; the panic itself is certain once the precondition holds.",
  "recommended_fix": "Guard num_entries != 0 before the entries[num_entries-1] fallback returns in kv_convert_vid2_to_vid7 (:90) and kv_convert_vid7_to_vid2 (:114).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree after source+harness verification; not built (no AMD hardware on guest).",
  "fix_evidence": "findings/poc/DF-3890/fix.diff"
}