# DF-4039 — polaris10_get_dependency_volt_by_clk fall-through reads dep_table->entries[count] twice (one-entry heap OOB read)

**File:** sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c
**Severity:** Low  |  **Class:** CWE-125 Out-of-bounds Read
**Status:** hardware-gated — source-certain; runtime reproduction impossible on the audit guest
(no Polaris GPU / no AMD53C974 HBA — see env.txt). Verdict: `inconclusive`, confidence `certain`.

## Build & run (on the DragonFly guest)

    ./build.sh     # compiles the demonstrator (uses the guest's kernel headers)
    ./run.sh       # reproduces the exact index arithmetic / branch selection

Expected: the `DF-4039` section of run.log shows the OOB offsets / panic-branch selection / fault.
Full guest details in env.txt.

## Fix validation

fix.diff applied (with all DF-4036..DF-4044 patches together) to a clean guest /usr/src copy;
`make nativekernel KERNCONF=X86_64_GENERIC` completed with 0 errors under -Werror
(see fix_build.log — polaris10_smumgr.o recompiled).
Sources restored to pristine afterwards (md5-verified).