# DF-4037 VERDICT — polaris10_populate_cac_table overflows BapmVddcVid{Lo,Hi,Hi2}Sidd[16] and OOB-reads vddc_voltage_table.entries[32]

## Bottom line

Source-certain OOB write+read in polaris10_populate_cac_table (polaris10_smumgr.c:712-718), fiji DF-4003 family: the loop is bounded by vddc_lookup_table->count, which the V1 parser sets to the RAW VBIOS ucNumEntries (u8<=255, process_pptables_v1_0.c:176) while the buffer itself is only allocated for 16 records (parser overflow DF-1574) — the polaris side then writes BapmVddcVidLoSidd/HiSidd/HiSidd2[16] past their bounds (count 17..255 -> up to 239B past each array, into GraphicsDpmLevelCount/LinkLevel/... and off smc_state_table), and reads data->vddc_voltage_table.entries[count] whose real table was trimmed to 16 (smu7_hwmgr.c:323-328) inside a fixed entries[32] array — indices 32..254 read past the pp_atomctrl_voltage_table into the rest of struct smu7_hwmgr. Demonstrated: run.log DF-4037 (24 OOB writes at count 40, 8 OOB reads past entries[32]). Hardware-gated -> runtime inconclusive, source certain.

## Exploit chain

crafted vBIOS vddc lookup table with ucNumEntries>16 -> parser count (buffer only sized 16, DF-1574) -> polaris10_populate_cac_table walk -> BapmVddcVid*[16] heap OOB write inside smc_state_table + entries[32] intra-struct OOB read

## Why not reproduced on the guest

The audit guest is QEMU/KVM with virtio display only: no AMD GPU, /dev/dri absent (env.txt), so polaris10_powerplay never binds — the crafted-VBIOS trigger cannot be exercised at runtime. The index arithmetic and struct geometry are proven against the kernel headers compiled verbatim (run.log), and the fix is compile-validated (fix_build.log).

## Negative results recorded alongside (pass-2 depth)

Checklist item kills: LinkLevel i<=count walk is bounded (pcie count clamped to <=7 at smu7_hwmgr.c:561-569); mc_reg-table walks are not in this file (smu7_smumgr.c owns them); fan-table div0 is known DF-1345; VCE/UVD count overflow is known DF-1346; Smio[32] and SmioTable.Pattern[4] walks are correctly clamped (SMU_MAX_SMIO_LEVELS).

## Fix

Bound the walk by min(lookup_table->count, SMU74_MAX_LEVELS_VDDC) and index vddc_voltage_table.entries modulo PP_ATOMCTRL_MAX_VOLTAGE_ENTRIES (fix.diff). Applied and compile-validated on the guest (fix_build.log); sys/ tree never modified by the audit.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.