# VERDICT — DF-4005

**Status: inconclusive at runtime (hardware-gated); source-certain.**

Demonstrated (run.log, section DF-4005): the fall-through tail of
`fiji_get_dependency_volt_by_clk` (`fiji_smumgr.c:398-416`) executes with
`i == dep_table->count` when the requested clock exceeds every entry; it reads
`dep_table->entries[i].vddc` at `:406` and `dep_table->entries[i].mvdd` at `:413`
— one entry (12 B of a 16 B record) past the exact-size heap allocation made by
`process_pptables_v1_0.c:425-436/378-391`. The demonstrator's poisoned redzone
byte (0x0001) shows adjacent-slab content being consumed as the branch condition
that decides whether `*mvdd` is populated. All sibling reads in the same block
correctly use `entries[i - 1]` (`:399/:404/:414`) — an off-by-one carried from
the 4.x upstream code. Impact is a bounded kernel heap OOB read with no direct
disclosure channel → Low.

Called on every graphics/memory level population (`:957`, `:1181`) — hot path,
not error path. Hardware-gated (env.txt).

Fix: `fix.diff` uses `entries[i - 1]` at both sites; nativekernel rebuild OK
(fix_build.log), reverted.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.