# VERDICT — DF-3974

**status: inconclusive** (hardware-gated; source-level certainty: certain)

## Why

Same reasoning as DF-3972: the guest has no radeon GPU (env.txt), and the zero-entry voltage object
must be present in the card's VBIOS VoltageObjectInfo table. The code path, however, is fully
deterministic once such a VBIOS is parsed:

```
radeon_dpm_enable (btc_dpm.c:2373)
 └─ 2392-2399 cypress_construct_voltage_tables
     └─ radeon_atom_get_voltage_table(VDDCI)  → ret 0, count = 0     [radeon_atombios.c:3789]
        (radeon_atom_get_voltage_table succeeds with zero entries; only entry-count > 32 rejected)
...first power-state change:
radeon_pm_compute_clocks → radeon_dpm_change_power_state_locked (radeon_pm.c:1137)
 └─ btc_dpm_pre_set_power_state (btc_dpm.c:2287)
     └─ btc_apply_state_adjust_rules (btc_dpm.c:2092)
         └─ 2233 btc_apply_voltage_delta_rules
             └─ 1315-1319 *vddc - *vddci > vddc_vddci_delta (200, hardcoded at 2696)
                 └─ btc_find_voltage(&eg_pi->vddci_voltage_table /* count==0 */, ...)  [1317]
                     └─ 1302 return table->entries[0xFFFFFFFF].value
                         → load at eg_pi + offsetof(vddci_voltage_table) + 0x7FFFFFFF8 → #PF
```

The u32 `count` type (radeon_mode.h:681) makes `count - 1` = 0xFFFFFFFF; the 8-byte entry stride
(radeon_mode.h:673-677) puts the faulting address ~32 GiB past the allocation — a wild read that
cannot land on anything mapped in the kernel's direct map on this guest's 4 GiB RAM, i.e. a
guaranteed panic rather than a lucky garbage pick. Exactly the DF-3649/DF-3956 family shape.

Preconditions beyond hardware: `pi->voltage_control` true (a VDDC GPIO voltage object must exist —
2392 gates the whole construct on it) with ≥1 entries, and `eg_pi->vddci_control` true
(btc_dpm.c:2636) with a VDDCI object whose entry count field is 0 — all plausible in a crafted ROM.

## Fix validation

not_testable (no hardware). fix.diff: early-out on count==0 in btc_find_voltage (mirror of the
`if (count)` guards used in cypress_populate_smc_voltage_tables).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.