# DF-4037 — polaris10_populate_cac_table overflows BapmVddcVid{Lo,Hi,Hi2}Sidd[16] and OOB-reads vddc_voltage_table.entries[32]

**File:** sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c
**Severity:** Medium  |  **Class:** CWE-787 Out-of-bounds Write (with CWE-125 read)
**Status:** hardware-gated — source-certain; runtime reproduction impossible on the audit guest
(no Polaris GPU / no AMD53C974 HBA — see env.txt). Verdict: `inconclusive`, confidence `certain`.

## Build & run (on the DragonFly guest)

    ./build.sh     # compiles the demonstrator (uses the guest's kernel headers)
    ./run.sh       # reproduces the exact index arithmetic / branch selection

Expected: the `DF-4037` section of run.log shows the OOB offsets / panic-branch selection / fault.
Full guest details in env.txt.

## Fix validation

fix.diff applied (with all DF-4036..DF-4044 patches together) to a clean guest /usr/src copy;
`make nativekernel KERNCONF=X86_64_GENERIC` completed with 0 errors under -Werror
(see fix_build.log — polaris10_smumgr.o recompiled).
Sources restored to pristine afterwards (md5-verified).