# DF-3974 — Wild OOB kernel read in btc_find_voltage when a VBIOS voltage object has zero LUT entries (count==0 → entries[0xFFFFFFFF], +32 GiB offset)

- File: `sys/dev/drm/radeon/btc_dpm.c:1293-1303` (sink), reached via `btc_apply_voltage_delta_rules`
  (btc_dpm.c:1305-1328) from `btc_apply_state_adjust_rules` (2233-2238)
- Class: CWE-125/CWE-191 (Medium) — family: DF-3649 (ci CAC count-0), DF-3956 (kv vid_mapping
  count-0). This is the btc empty-voltage-table twin.

## Build / Run / Expected

Hardware-gated (Barts/Turks/Caicos + VBIOS whose VDDCI or VDDC voltage object carries a zero entry
count). Panic (page fault on unmapped read) or silent garbage voltage pick.

## Root cause

1. `radeon_atom_get_voltage_table()` — `sys/dev/drm/radeon/radeon_atombios.c:3712-3805` — returns
   **0 (success)** with `voltage_table->count == 0` when the V2 object's `ucNumOfVoltageEntries == 0`
   (loop skipped, count assigned at 3758) or the V3 GPIO object's `ucGpioEntryNum == 0` (3789).
2. `cypress_construct_voltage_tables()` — `cypress_dpm.c:1487-1513` — only trims when
   `count > MAX_NO_VREG_STEPS`; count==0 passes through as success.
3. `btc_find_voltage()` — `btc_dpm.c:1293`:
   ```c
   for (i = 0; i < table->count; i++) { ... }
   return table->entries[table->count - 1].value;   /* count==0 → entries[0xFFFFFFFF] */
   ```
   `count` is `u32` (radeon_mode.h:681); `entries` is `entries[32]` of 8-byte entries
   (radeon_mode.h:671-685). Index 0xFFFFFFFF zero-extends → byte offset 0x7_FFFF_FFF8 (~32 GiB) past
   `eg_pi->vddci_voltage_table` (embedded in the kmalloc'd evergreen_power_info) → wild read →
   page fault → panic; if something is somehow mapped there, an unrelated 16-bit value becomes the
   programmed VDDCI (hardware misregulation).
4. Reachability: `btc_apply_voltage_delta_rules` (1305) is called on every
   `btc_dpm_pre_set_power_state` → `btc_apply_state_adjust_rules` (2233-2238) with the parsed
   non-zero vddc/vddci values; the guard at 1312 only rejects zero *voltages*, not zero *table
   counts*. The vddci branch (1315-1320) fires when `*vddc - *vddci > vddc_vddci_delta` with an empty
   vddci table; the vddc branch (1321-1326) symmetrically.

Note `cypress_populate_smc_voltage_tables` (cypress_dpm.c:1534/1552) *does* guard with
`if (...count)` — the btc path simply forgot the same guard.