# VERDICT — DF-4002

**Status: inconclusive at runtime (hardware-gated); source-certain.**

Reproduced in the guest demonstrator (run.log, section DF-4002): with
`mm_dep_table->count = 20` (a single VBIOS byte, max 255), the exact walk shape of
`fiji_populate_smc_vce_level` (`fiji_smumgr.c:1436-1457`) writes 12 × 12 B past
`VceLevel[8]`; the ACP twin (`:1475-1494`) 12 × 12 B past `AcpLevel[8]`; the UVD
twin (`:1572-1601`) 12 × 16 B past `UvdLevel[8]` — all inside the heap-resident
`smc_state_table` of the `fiji_smumgr` kzalloc (`:339`), running off the
allocation at count 255 (~3 KB). Count provenance: `process_pptables_v1_0.c:698-712`
(`mm_table->count = mm_dependency_table->ucNumEntries`, no clamp anywhere);
fiji pinned to this parser at `hwmgr.c:86/127`. Sinks reached unconditionally
from `fiji_init_smc_table:1976/1980/1992`.

No in-kernel observation possible: guest has no AMD GPU (env.txt). Trigger
context = crafted vBIOS / hostile eGPU at driver attach — DF-1271 (tonga) /
DF-1296 (ci) / DF-1346 (polaris10) / DF-1366-67 (vegam) family, fiji variant;
those siblings were rated High, likewise here.

Fix: `fix.diff` NULL-checks and clamps each walk to SMU73_MAX_LEVELS_{VCE,ACP,UVD};
applied to guest /usr/src, full nativekernel rebuild OK (fix_build.log), reverted.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.