{
  "finding_id": "DF-3974",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "btc_find_voltage (btc_dpm.c:1293-1303) indexes entries[count-1] with a u32 count; radeon_atom_get_voltage_table returns success with count==0 for a VBIOS voltage object whose LUT entry count is zero (radeon_atombios.c:3758/3789), and cypress_construct_voltage_tables only trims counts > 32 — so a crafted VDDCI/VDDC object yields entries[0xFFFFFFFF] ≈ +32 GiB wild read → kernel page fault during the first power-state change (btc_apply_state_adjust_rules → btc_apply_voltage_delta_rules, btc_dpm.c:2233/1317). Hardware-gated: no radeon GPU in the guest, so inconclusive-by-hardware with source-level certainty; exact twin of DF-3649/DF-3956.",
  "exploit_chain": "",
  "evidence": "VERDICT.md deterministic trace; radeon_mode.h:671-685 (u32 count, entries[32], 8-byte entries); the sibling guards at cypress_dpm.c:1534/1552 prove the intended pattern",
  "kernel_refs": ["sys/dev/drm/radeon/btc_dpm.c:1293", "sys/dev/drm/radeon/btc_dpm.c:1302", "sys/dev/drm/radeon/btc_dpm.c:1317", "sys/dev/drm/radeon/btc_dpm.c:1323", "sys/dev/drm/radeon/btc_dpm.c:2233", "sys/dev/drm/radeon/radeon_atombios.c:3758", "sys/dev/drm/radeon/radeon_atombios.c:3789", "sys/dev/drm/radeon/cypress_dpm.c:1497", "sys/dev/drm/radeon/radeon_mode.h:681"],
  "poc_changes": "No PoC: hardware-gated (crafted VBIOS voltage object on Barts-class hardware).",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 10,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Read-only wild access (panic-class DoS), same rating family as DF-3649 (Medium).",
  "recommended_fix": "Guard table->count == 0 in btc_find_voltage (return voltage unchanged), mirroring the count guards in cypress_populate_smc_voltage_tables.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": null,
  "fix_patched_reproduced": null,
  "fix_verdict": "fix.diff authored (count==0 early-out); not build-testable without a Barts-class GPU.",
  "fix_evidence": "findings/poc/DF-3974/fix.diff"
}