# DF-4000 — Unclamped VBIOS SCLK/MCLK DPM counts overflow iceland SMC tables (GraphicsLevel[8], MemoryLevel[4], 384-B stack arb table, mc_regs.data[4])

**File:** `sys/dev/drm/amd/powerplay/smumgr/iceland_smumgr.c` (pass 2)
**Class:** kernel heap + stack OOB writes from crafted VBIOS (hardware-gated).
Sibling of DF-3908/DF-3909 (tonga) and DF-3939/DF-3940 (CI); DF-1166 covers the
upstream smu7_hwmgr dpm_levels[8] overflow on the same chain.

## Reproduce (index-math demonstrator; kernel fault needs a Topaz GPU with crafted VBIOS)

```
scp -F dfbsd-qemu/config trigger_analysis.c dfbsd-maxx:/tmp/
vm.sh run_user 'cc -O2 -Wall -o /tmp/iceland_trig /tmp/trigger_analysis.c && /tmp/iceland_trig'
```

## Expected

```
GraphicsLevel[8]: +48 bytes past the GraphicsLevel[8] array -> 4/12 writes OOB (max +192)
MemoryLevel[4]:  +72 bytes past  -> 2/6 writes OOB (max +144), [count-1] indexes [5]
arb_regs.entries[7][4]: linear entry 32 of 32 -> 26 of 72 STACK writes OOB (max +216 past the 384-byte object)
2/6 mc_regs.data[] writes OOB + copy_bytes of sizeof(MCRegisterSet)*6 past mc_regs
DONE (source-certain; kernel fault itself hardware-gated)
```

## Fix validation

fix.diff applied to clean guest /usr/src; full `make nativekernel KERNCONF=X86_64_GENERIC`:
completed 11:59:41, error_count=0, iceland_smumgr.c compiled under -Werror
(fix_build.log / fix_kernel_full.log:11214). Patch reverted after validation.