{
  "finding_id": "DF-4036",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain kernel heap + stack OOB writes, iceland/fiji DF-4000/DF-4001 family on SMU74: the SCLK/MCLK dpm counts flow unclamped from the VBIOS PowerPlay dependency tables (process_pptables_v1_0.c ucNumEntries u8<=255 -> smu7_hwmgr.c:783-810 dpm_table.*.count, no clamp) into polaris10_populate_all_graphic_levels (polaris10_smumgr.c:1000-1017, GraphicsLevel[8] writes + GraphicsDpmLevelCount truncation that re-feeds update_dpm_settings:2427), polaris10_populate_all_memory_levels (:1138-1148, MemoryLevel[4] writes incl. the [count-1] DisplayWatermark/EnabledForActivity stores at :1145-1148, MemoryDpmLevelCount truncation) and polaris10_program_memory_timing_parameters (:1365-1380, the 384-byte STACK SMU74_Discrete_MCArbDramTimingTable arb_regs with entries[8][4]: mclk count 5+ corrupts entries[i+1] rows silently and runs off the table at i==7,j>=4 or i>=8; sclk/mclk 255/255 reaches 15300B past). Demonstrated on the guest with the kernel headers: run.log DF-4036a/b/c (224B/48B redzone dirty at counts 12/6; 26 stack-entry writes past the 32-entry table). Hardware-gated: no Polaris GPU on the audit guest -> runtime inconclusive, source certain.",
  "exploit_chain": "crafted vBIOS PowerPlay table with sclk/mclk dependency ucNumEntries > 8/4 -> dpm tables -> polaris10 populate walks -> heap OOB writes in struct polaris10_smumgr (kzalloc) + kernel stack smash past the 384B arb_regs local",
  "evidence": "run.log sections DF-4036a/b/c (redzone scans + stack-frame smash counts); VERDICT.md; fix_build.log; env.txt",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:1000",
    "sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:1017",
    "sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:1138",
    "sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:1145",
    "sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:1365",
    "sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:1374",
    "sys/dev/drm/amd/powerplay/inc/smu74_discrete.h:179",
    "sys/dev/drm/amd/powerplay/inc/smu74_discrete.h:281",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:783"
  ],
  "poc_changes": "Pass-2 reviewer authored demonstrator compiling the kernels own headers (smu74.h/smu74_discrete.h packed, or a verbatim copy of the drivers amdsentmsg/parsemsg arms) so struct geometry and branch selection are the kernels; fix.diff generated against the pristine file and compile-validated via full nativekernel rebuild on the guest (shared build with DF-4036..DF-4044, fix_build.log).",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 400,
  "guest_dirty": 0,
  "build_cmd": "./build.sh",
  "run_cmd": "./run.sh",
  "code_hash": "a80c6d8179c5b51037b9b3c57bf5e23b8ff1b9791b667178a4b0fd8bf2b68475",
  "notes": "Hardware-gated (no Polaris GPU on guest; crafted-VBIOS threat model; amd-gpu absent per env.txt). Checklist kills: LinkLevel walk bounded (smu7_hwmgr.c:561-569 clamp), mc_reg walks not in this file, fan div0 = known DF-1345, VCE/UVD overflow = known DF-1346, Smio walks clamped.",
  "recommended_fix": "Clamp every SCLK/MCLK-driven walk to SMU74_MAX_LEVELS_GRAPHICS/MEMORY and SMU__NUM_SCLK_DPM_STATE/SMU__NUM_MCLK_DPM_LEVELS, index dpm_levels modulo MAX_REGULAR_DPM_NUMBER, and store clamped min() into the *DpmLevelCount fields (fix.diff)",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (nativekernel X86_64_GENERIC rebuilt with all DF-4036..DF-4044 patches; 0 errors under -Werror; see fix_build.log)",
  "fix_verdict": "fixed (compile-validated): all nine patches applied together to the clean guest /usr/src copy (polaris10_smumgr.c md5 6f39bb32..->19a2b278.., amd.c f577a330..->54ce1518..), make -j4 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with 0 compile errors under -Werror; the patched polaris10_smumgr.o (amdgpu module) and amd.o (GENERIC kernel) both recompiled. Runtime re-test impossible on this guest (device absent). Sources restored to pristine and md5-verified after validation.",
  "fix_evidence": "findings/poc/DF-4036/fix.diff; findings/poc/DF-4036/fix_build.log (build banner + compile lines + 0 errors)"
}