# VERDICT — DF-4003

**Status: inconclusive at runtime (hardware-gated); source-certain.**

Demonstrated (run.log, section DF-4003): with `vddc_lookup_table->count = 40`
(VBIOS ucNumEntries; the 16-record alloc itself is DF-1574's pass-1 finding), the
loop at `fiji_smumgr.c:772-779` writes 24 bytes past `BapmVddcVidLoSidd[16]` and
the same past `BapmVddcVidHiSidd[16]` (arrays at `smu73_discrete.h:228-230`,
SMU73_MAX_LEVELS_VDDC=16), and performs 8 OOB reads of the fixed
`vddc_voltage_table.entries[32]` (`:774`, `ppatomctrl.h:45`). At count 255: 239 B
past each array (clobbering the level-count fields / GraphicsLevel region of
smc_state_table) and 223 reads past entries[32] inside `struct smu7_hwmgr`.

Reached from `fiji_init_smc_table:1936-1937` whenever voltage_control != NONE
(the SVI2 default). Hardware-gated like the other fiji findings (env.txt).

Fix: `fix.diff` clamps the walk to SMU73_MAX_LEVELS_VDDC and bounds the
entries[] read; nativekernel rebuild OK (fix_build.log), reverted.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.