# DF-3908 — Verification Verdict

**Status:** inconclusive (reproduced=0)
**Impact:** none (no Tonga/Fiji hardware on the guest)
**Confidence:** certain (source-level)

## Finding
VBIOS-controlled SCLK/MCLK DPM counts (bounded only by the u8 dependency-table
entry count) index the fixed `entries[8][4]` **stack** table
`SMU72_Discrete_MCArbDramTimingTable arb_regs` in
`tonga_program_memory_timing_parameters()` without any clamp → kernel stack
OOB write at driver init / OD reprogram time.

## Source proof chain
1. `process_pptables_v1_0.c` `get_sclk_voltage_dependency_table` /
   `get_mclk_voltage_dependency_table` allocate the dep tables with
   `count = ucNumEntries` (u8 ≤ 255) — count is VBIOS-controlled.
2. `smu7_hwmgr.c:752-830` `smu7_setup_dpm_tables_v1()` copies every distinct
   clock into `dpm_table->sclk_table` / `mclk_table`, incrementing
   `count` per accepted entry — never clamped to SMU72_MAX_LEVELS_*
   (the dpm_levels[8] overflow on the way is already filed as DF-1166).
3. `smu7_hwmgr.c:3780-3817` `smu7_trim_*` only flips `enabled`, never
   reduces count.
4. `tonga_smumgr.c:2296` calls `tonga_program_memory_timing_parameters()`
   from `tonga_init_smc_table()` (and from the OD path at :2552-2561).
5. `tonga_smumgr.c:1492` declares `arb_regs` (384-byte stack object);
   `:1497-1502` indexes `arb_regs.entries[i][j]` for
   `i < sclk_table.count`, `j < mclk_table.count` — OOB for i≥8 / j≥4.
   Max extent: (255*4+255)*12 ≈ 15.3 KB past a 384-byte frame.
6. Array dims: `smu72_discrete.h:156-169`
   (`entries[SMU__NUM_SCLK_DPM_STATE=8][SMU__NUM_MCLK_DPM_LEVELS=4]`,
   entry = 2×uint32 + uint8 + pad = 12 B).

## Why inconclusive, not reproduced
The path executes only during AMD GPU powerplay init on Tonga/Fiji
(chip family AMDGPU_FAMILY_VI, tonga/fiji ASICs). The QEMU guest has no AMD
GPU (env.txt: pciconf shows only Intel/QEMU virtual PCI devices). The
userspace demonstrator (`run.log`) reproduces the exact index arithmetic and
shows 26 OOB writes for a modest 12×6 crafted VBIOS, but cannot fault a
kernel stack that never runs.

## Fix validation
`fix.diff` clamps both loops with `MIN(count, SMU72_MAX_LEVELS_*)`. Applied
on the guest's clean `/usr/src` together with DF-3909/3910/3911/3912; full
`make -j4 nativekernel KERNCONF=X86_64_GENERIC`:
`tonga_smumgr.c` compiled with `-Werror` (fix_kernel_full.log:28191),
error count 0, "Kernel build for X86_64_GENERIC completed", rc=0
(fix_build.log). fix_status = **fixed** (compile-validated; runtime
validation requires hardware).

## Prior art
Checklist item (a) — the smu7_hwmgr.c twin (amd_pp_clocks.clock[16] stack
copies) is DF-3684; this is the tonga_smumgr.c stack-table sink, not covered
by DF-1271..DF-1275.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.