# DF-4038 VERDICT — polaris10 clock-stretcher walk overflows Sclk_voltageOffset[8] using the raw VBIOS SCLK-dependency count; AVFS walk OOB-reads entries[i<8] when the count is lower

## Bottom line

Source-certain heap OOB write + read over table_info->vdd_dep_on_sclk (the RAW VBIOS dependency table, allocated with exactly count entries — hwmgr_ppt.h entries[1] flex): polaris10_populate_clock_stretcher_data_table walks i < sclk_table->count (polaris10_smumgr.c:1555) writing Sclk_voltageOffset[8] (:1574) — count>8 smears DpmTable+1704 (of 1884) past the array into ClockStretcherDataTable/CKS_LOOKUPTable and off smc_state_table; the walk runs BEFORE the stretch_amount validation at :1579 so even a rejected VBIOS value smears first; cks_enable<<i at :1556 is shift-UB for i>=8 (value only). The mirror bug in polaris10_populate_avfs_parameters (:1688-1691) walks i < NUM_VFT_COLUMNS=8 reading sclk_table->entries[i] regardless of count — a VBIOS with fewer than 8 SCLK dep entries reads past the heap allocation and the values are uploaded to SMU (:1697-1710). Demonstrated: run.log DF-4038a/b. fiji DF-4004 sibling. Hardware-gated -> runtime inconclusive, source certain.

## Exploit chain

crafted vBIOS: (a) vdd_dep_on_sclk->count > 8 -> Sclk_voltageOffset[8] OOB byte writes; (b) count < 8 -> AVFS walk reads entries past the allocation, values go to SMU

## Why not reproduced on the guest

The audit guest is QEMU/KVM with virtio display only: no AMD GPU, /dev/dri absent (env.txt), so polaris10_powerplay never binds — the crafted-VBIOS trigger cannot be exercised at runtime. The index arithmetic and struct geometry are proven against the kernel headers compiled verbatim (run.log), and the fix is compile-validated (fix_build.log).

## Negative results recorded alongside (pass-2 depth)

Checklist item kills: LinkLevel i<=count walk is bounded (pcie count clamped to <=7 at smu7_hwmgr.c:561-569); mc_reg-table walks are not in this file (smu7_smumgr.c owns them); fan-table div0 is known DF-1345; VCE/UVD count overflow is known DF-1346; Smio[32] and SmioTable.Pattern[4] walks are correctly clamped (SMU_MAX_SMIO_LEVELS).

## Fix

Clamp the clock-stretcher walk to NUM_VFT_COLUMNS(8) and bound the AVFS walk by sclk_table->count (fix.diff). Applied and compile-validated on the guest (fix_build.log); sys/ tree never modified by the audit.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.