# DF-4002 — Unclamped VBIOS MM-dependency count overflows fiji UvdLevel[8]/VceLevel[8]/AcpLevel[8] SMC arrays

**File:** `sys/dev/drm/amd/powerplay/smumgr/fiji_smumgr.c`
**Class:** kernel heap OOB write (memcorrupt) — DF-1271 (tonga) / DF-1296 (ci) / DF-1346 (polaris10) / DF-1366-67 (vegam) family, fiji variant
**Severity:** High · **Confidence:** certain (source) · runtime hardware-gated

## Build / Run / Expected
Same demonstrator as DF-4001 (`./build.sh && ./run.sh`, section `=== DF-4002 ===`):
```
VceLevel[8]:  mm_count=20 -> 12 OOB writes, 144 bytes past
AcpLevel[8]:  mm_count=20 -> 12 OOB writes, 144 bytes past
UvdLevel[8]:  mm_count=20 -> 12 OOB writes, 192 bytes past
```

## Source chain
`table_info->mm_dep_table->count` = VBIOS `ucNumEntries` (u8 ≤ 255) verbatim
(`process_pptables_v1_0.c:698-712`); fiji pinned to this parser (hwmgr.c:86/127).
Consumers index fixed arrays without any clamp:
- `fiji_populate_smc_vce_level` — `table->VceLevelCount = (uint8_t)(mm_table->count)` (:1433),
  walk `:1436-1457` writes `VceLevel[count]` (`SMU73_Discrete_ExtClkLevel` 12 B × 8, `smu73_discrete.h:255`)
- `fiji_populate_smc_acp_level` — same shape `:1472`, walk `:1475-1494` into `AcpLevel[8]` (`:256`)
- `fiji_populate_smc_uvd_level` — same shape `:1569`, walk `:1572-1601` into `UvdLevel[8]` (16 B × 8, `:254`)

Arrays sit at DpmTable offsets ~+864/+960/+1056 of 1632 B inside the `fiji_smumgr`
kzalloc; count 255 writes ~3 KB past, running off the end of the allocation into
adjacent heap. Reached unconditionally from `fiji_init_smc_table:1976/1980/1992`.

## Fix
`fix.diff` (shared with DF-4001 pack): NULL-check + clamp each populate walk to
SMU73_MAX_LEVELS_{VCE,ACP,UVD}. Compile-validated via nativekernel rebuild (fix_build.log).