# DF-3909 — Verification Verdict

**Status:** inconclusive (reproduced=0)
**Impact:** none (no Tonga/Fiji hardware on the guest)
**Confidence:** certain (source-level)

## Finding
`tonga_populate_all_graphic_levels()` / `tonga_populate_all_memory_levels()`
write `smc_state_table.GraphicsLevel[i]` (i < sclk_table.count) and
`MemoryLevel[i]` (i < mclk_table.count) — fixed arrays of 8 and 4 entries —
plus `MemoryLevel[count-1]` (:1133, unguarded) and
`GraphicsLevel[GraphicsDpmLevelCount-1]` (stretcher read, :1673-1675).
Counts are VBIOS-controlled (u8 dep-table entry counts; see DF-3908 chain)
and never clamped to the array bounds → heap OOB writes/reads inside (and
past, for large counts) the kzalloc'd `struct tonga_smumgr`.

## Source proof chain
1. Count provenance: process_pptables_v1_0.c get_{sclk,mclk}_voltage_dependency_table
   (count = ucNumEntries, u8) → smu7_hwmgr.c smu7_setup_dpm_tables_v1
   (:752-830, no clamp; dpm_levels[8] overflow en route is DF-1166).
2. Sinks: tonga_smumgr.c:709-712 (GraphicsLevel[i] populate),
   :725-727 (count>1 → GraphicsLevel[count-1]),
   :739-742 and :769-776 (pcieDpmLevel stores for i < count),
   :1107-1114 (MemoryLevel[i] populate), :1120/:1127-1128 (MemoryLevel[0]
   fixed stores), :1133 (MemoryLevel[count-1], no count>0 guard),
   :1673-1675 (GraphicsLevel[GraphicsDpmLevelCount-1] read).
3. Array dims: smu72_discrete.h:265-267 (GraphicsLevel[8], MemoryLevel[4]);
   struct order GraphicsLevel → MemoryACPILevel → MemoryLevel[4] → LinkLevel[8]
   → … determines what gets stomped.
4. memset at :707/:1105 only covers sizeof(level)×MAX — no protection.

## Why inconclusive
Same as DF-3908: the path runs only on Tonga/Fiji powerplay init; guest has
no AMD GPU. The demonstrator (run.log) shows the OOB write extents for
count=16/9 (e.g. worst GraphicsLevel write ends +512 B past the array) and
the count==0 wild-index form.

## Fix validation
`fix.diff` introduces `sclk_count`/`mclk_count` = MIN(count, array bound) at
every indexing site, guards the count-1 stores with count>0. Applied with
the other four batch fixes; full nativekernel rebuild rc=0, `-Werror` clean
(fix_build.log; tonga compile at fix_kernel_full.log:28191 in DF-3908 pack).
fix_status = **fixed** (compile-validated).

## Not covered by knowns
DF-1271 (UVD/VCE/ACP levels via mm_dep count) and DF-1272
(Sclk_voltageOffset via vdd_dep_on_sclk) are different sinks and drivers;
LinkLevel[8] was checked and is NOT reachable (pcie count clamped ≤7 in
smu7_setup_pcie_table, smu7_hwmgr.c:556-569).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.