{
  "finding_id": "DF-3956",
  "title": "vid_mapping_table num_entries==0 -> entries[0xFFFFFFFF] wild read (~16 GiB) in kv_convert_vid2_to_vid7 / kv_convert_vid7_to_vid2 (radeon kv_dpm)",
  "file": "sys/dev/drm/radeon/kv_dpm.c",
  "severity": "Low",
  "status": "inconclusive",
  "impact_class": "panic (hardware+VBIOS-gated DoS, wild OOB read)",
  "verdict": {
    "reproduced": false,
    "confidence": "certain (source), runtime-inconclusive on this guest",
    "summary": "sumo_construct_vid_mapping_table can leave num_entries==0 (empty sAvail_SCLK or missing IntegratedSystemInfo - kv_parse_sys_info_table :2495-2546 returns 0 with the table skipped); with vddc_dependency_on_sclk.count==0 the else-branch of kv_convert_vid2_to_vid7 (:566) / kv_convert_vid7_to_vid2 (:590) evaluates entries[num_entries-1] = entries[0xFFFFFFFF] = +0x3FFFFFFFC.",
    "harness_result": "producer replay => num_entries = 0; verbatim consumer expression against guard page: SIGSEGV sig=11; 'RESULT: WILD READ FAULTS AS PREDICTED'"
  },
  "kernel_refs": [
    "sys/dev/drm/radeon/kv_dpm.c:566",
    "sys/dev/drm/radeon/kv_dpm.c:590",
    "sys/dev/drm/radeon/kv_dpm.c:604",
    "sys/dev/drm/radeon/kv_dpm.c:2382",
    "sys/dev/drm/radeon/kv_dpm.c:2495",
    "sys/dev/drm/radeon/sumo_dpm.c:1616",
    "sys/dev/drm/radeon/sumo_dpm.h:65"
  ],
  "reproduce": {
    "build": "cd findings/poc/DF-3956 && ./build.sh",
    "run": "cd findings/poc/DF-3956 && ./run.sh",
    "expected": "analysis: 'producer: ... num_entries = 0', 'entries[0xffffffff] -> +0x3fffffffc (16.00 GiB)'; crash: child SIGNALLED sig=11, 'RESULT: WILD READ FAULTS AS PREDICTED'"
  },
  "artifacts": [
    "README.md", "VERDICT.md", "trigger_df3956.c", "build.sh", "run.sh",
    "build.log", "run.log", "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}