# VERDICT — DF-4004

**Status: inconclusive at runtime (hardware-gated); source-certain.**

Demonstrated (run.log, section DF-4004): with raw `vdd_dep_on_sclk->count = 12`
the walk at `fiji_smumgr.c:1706-1719` writes `Sclk_voltageOffset[8..11]` — the
array is `uint8_t[8]` at DpmTable+1576 of 1632 (`smu73_discrete.h:361`), the
struct tail. Count 255 writes 247 B past the array, off the end of `smc_state_table`
into the remainder of the `fiji_smumgr` allocation and past it. Distinct from
DF-4001: this walk uses the RAW dependency-table count (`table_info->vdd_dep_on_sclk`),
not the dedup'd dpm count, so even a VBIOS whose dedup collapses below 8 still
overflows. The DDT walk `:1792-1795` additionally OOB-reads `GraphicsLevel[j]`.

Gating (PP_TABLE_V1 + feature_mask + usClockStretchAmount != 0,
`smu7_hwmgr.c:1664-1668`) is satisfiable by the crafted vBIOS itself, and the
walk precedes the stretch_amount range check at `:1731`.

DF-1272 (tonga Sclk_voltageOffset[8]) sibling; Medium because of the cap gate
and the 1-byte-per-entry write granularity. Hardware-gated (env.txt).

Fix: `fix.diff` clamps both walks; nativekernel rebuild OK (fix_build.log), reverted.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.