# DF-4004 — fiji clock-stretcher walk overflows Sclk_voltageOffset[8] with the raw VBIOS SCLK-dep count

**File:** `sys/dev/drm/amd/powerplay/smumgr/fiji_smumgr.c:1706-1719` (DDT read walk `:1792-1810`)
**Class:** kernel heap OOB write (memcorrupt) — DF-1272 (tonga Sclk_voltageOffset[8]) sibling
**Severity:** Medium · **Confidence:** certain (source) · runtime hardware-gated

## Build / Run / Expected
Same demonstrator as DF-4001 (`./build.sh && ./run.sh`, section `=== DF-4004 ===`):
```
dep_sclk->count=12 (RAW count, not the dedup'd dpm count): writes at [8..11] are OOB
array sits at DpmTable+1576 of 1632B ... count 255 writes 247B past the array, off the end of smc_state_table
```

## Source chain
`fiji_populate_clock_stretcher_data_table` walks
`for (i = 0; i < sclk_table->count; i++)` where `sclk_table = table_info->vdd_dep_on_sclk`
(the RAW VBIOS dep table, count = ucNumEntries ≤ 255 — not even the dedup'd
dpm count) and writes `smc_state_table.Sclk_voltageOffset[i]` (`:1718`) — a fixed
`uint8_t[8]` at DpmTable+1576 (`smu73_discrete.h:361`) followed only by
ClockStretcherDataTable/CKS_LOOKUPTable (struct tail): count > ~24 runs past the
whole `smc_state_table` into the remainder of the `fiji_smumgr` allocation
(ulv_setting/power_tune_table) and beyond. The second walk (`:1792`) reads
`GraphicsLevel[j]` for j < GraphicsDpmLevelCount (also unclamped, OOB read).

Gating: `PHM_PlatformCaps_ClockStretcher` is set for PP_TABLE_V1 parts when
`feature_mask & PP_CLOCK_STRETCH_MASK && usClockStretchAmount != 0`
(`smu7_hwmgr.c:1664-1668`); the walk executes BEFORE the stretch_amount range
check at `:1731`, so even a "rejected" VBIOS amount smears the table first.

## Fix
`fix.diff` (shared): clamp both walks (i < 8 / j < SMU73_MAX_LEVELS_GRAPHICS).
Compile-validated via nativekernel rebuild (fix_build.log).