# DF-4003 — fiji_populate_cac_table overflows BapmVddcVid{Lo,Hi}Sidd[16] and reads vddc_voltage_table.entries[32] OOB

**File:** `sys/dev/drm/amd/powerplay/smumgr/fiji_smumgr.c:772-779`
**Class:** kernel heap OOB write + OOB read (memcorrupt/kernleak)
**Severity:** Medium · **Confidence:** certain (source) · runtime hardware-gated

## Build / Run / Expected
Same demonstrator as DF-4001 (`./build.sh && ./run.sh`, section `=== DF-4003 ===`):
```
vddc_lookup_count=40: 24 OOB writes past BapmVddcVidLoSidd[16] (and same for HiSidd), 8 OOB reads of vddc_voltage_table.entries[32]
```

## Source chain
`table_info->vddc_lookup_table->count` = VBIOS `ucNumEntries` verbatim
(`process_pptables_v1_0.c:176` — the lookup buffer itself is only allocated for 16
records, DF-1574 pass 1). `fiji_populate_cac_table` (`:756-782`) then loops
`for (count = 0; count < lookup_table->count; count++)` and
- writes `table->BapmVddcVidLoSidd[count]` and `BapmVddcVidHiSidd[count]`
  (arrays `[SMU73_MAX_LEVELS_VDDC=16]`, `smu73_discrete.h:228-230`) → 239 B past
  each at count 255, clobbering HiSidd2/level-counts/... inside smc_state_table,
  and past the DpmTable end for large counts;
- READS `data->vddc_voltage_table.entries[count].value` (`:774`) — a fixed
  `entries[PP_ATOMCTRL_MAX_VOLTAGE_ENTRIES=32]` array inside `struct smu7_hwmgr`
  (`ppatomctrl.h:45,207`) → 223 entries past at count 255 (OOB read consumed by
  `phm_get_voltage_index`, i.e. `smu_helper.c:385-403`).

Gated on `voltage_control != SMU7_VOLTAGE_CONTROL_NONE` (`fiji_init_smc_table:1936-1937`)
— the normal case on SVI2 boards.

## Fix
`fix.diff` (shared): clamp the walk to SMU73_MAX_LEVELS_VDDC and modulo the
entries[32] read. Compile-validated via nativekernel rebuild (fix_build.log).