# DF-4005 — fiji_get_dependency_volt_by_clk fall-through reads dep_table->entries[count] (one-entry heap OOB read ×2)

**File:** `sys/dev/drm/amd/powerplay/smumgr/fiji_smumgr.c:404-414` (reads at `:406` and `:413`)
**Class:** kernel heap OOB read (kernleak-class; value used only as a branch condition)
**Severity:** Low · **Confidence:** certain (source) · runtime hardware-gated

## Build / Run / Expected
Same demonstrator as DF-4001 (`./build.sh && ./run.sh`, section `=== DF-4005 ===`):
```
count=3, i=3 after fall-through; entries[i].mvdd reads bytes at +60, 12 bytes past the 3-entry heap object
value read = 0x0001 (poisoned adjacent-slab byte) — kernel heap adjacent-slab bytes consumed as a branch condition
```

## Source chain
When the requested clock exceeds every entry (loop `:368-396` falls through),
`i == dep_table->count` and the tail block reads
- `:406` `dep_table->entries[i].vddc` (inside the vddci lookup),
- `:413` `dep_table->entries[i].mvdd` (mvdd condition),
both one entry past the `kmalloc(count * sizeof(entry))` allocation made in
`process_pptables_v1_0.c:425-436/378-391`. The in-bounds twin reads correctly use
`entries[i - 1]` (`:399`, `:404`, `:414`). The OOB bytes only select whether
`*mvdd` gets set — no direct disclosure, but a genuine heap OOB read on the hot
per-level voltage path. Carried from the upstream 4.x code as-is.

## Fix
`fix.diff` (shared): use `entries[i - 1]` at both sites. Compile-validated via
nativekernel rebuild (fix_build.log).