# DF-4038 — polaris10 clock-stretcher walk overflows Sclk_voltageOffset[8] using the raw VBIOS SCLK-dependency count; AVFS walk OOB-reads entries[i<8] when the count is lower

**File:** sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c
**Severity:** Medium  |  **Class:** CWE-787 Out-of-bounds Write (with CWE-125 read)
**Status:** hardware-gated — source-certain; runtime reproduction impossible on the audit guest
(no Polaris GPU / no AMD53C974 HBA — see env.txt). Verdict: `inconclusive`, confidence `certain`.

## Build & run (on the DragonFly guest)

    ./build.sh     # compiles the demonstrator (uses the guest's kernel headers)
    ./run.sh       # reproduces the exact index arithmetic / branch selection

Expected: the `DF-4038` section of run.log shows the OOB offsets / panic-branch selection / fault.
Full guest details in env.txt.

## Fix validation

fix.diff applied (with all DF-4036..DF-4044 patches together) to a clean guest /usr/src copy;
`make nativekernel KERNCONF=X86_64_GENERIC` completed with 0 errors under -Werror
(see fix_build.log — polaris10_smumgr.o recompiled).
Sources restored to pristine afterwards (md5-verified).