# DF-4041 VERDICT — polaris10 MVDD stash walks: SmioTable2.Pattern reads entries[count] instead of entries[level]; populate_mvdd_value walks the raw MCLK-dependency count past mvdd_voltage_table.entries[32]

## Bottom line

Source-certain MCLK-stash defects (polaris-unique checklist item h): (a) polaris10_populate_smc_mvdd_table writes Pattern[level] but reads data->mvdd_voltage_table.entries[count] with count = min(table count, SMU_MAX_SMIO_LEVELS=4) (polaris10_smumgr.c:657) — a wrong-index read one past the VALID (trimmed-to-4, smu7_hwmgr.c:344-349) entries, so every MVDD smio pattern is programmed with the stale/zero slot (demonstrated: run.log DF-4041a — all patterns 0 instead of 1100..1400); (b) polaris10_populate_mvdd_value loops i < vdd_dep_on_mclk->count (RAW VBIOS u8, :1183) reading mvdd_voltage_table.entries[i] from the fixed entries[PP_ATOMCTRL_MAX_VOLTAGE_ENTRIES=32] array (:1185) — dep counts 33..255 read past the pp_atomctrl_voltage_table into the rest of struct smu7_hwmgr (intra-struct heap OOB read; loop only stops early if a clk happens to match). Demonstrated: run.log DF-4041b (8 reads past at count 40). Hardware-gated -> runtime inconclusive, source certain.

## Exploit chain

crafted vBIOS: (a) any GPIO-MVDD board config -> all MVDD patterns read the zero slot (mis-programmed memory voltage); (b) vdd_dep_on_mclk->count > 32 -> entries[i] intra-struct OOB reads

## Why not reproduced on the guest

The audit guest is QEMU/KVM with virtio display only: no AMD GPU, /dev/dri absent (env.txt), so polaris10_powerplay never binds — the crafted-VBIOS trigger cannot be exercised at runtime. The index arithmetic and struct geometry are proven against the kernel headers compiled verbatim (run.log), and the fix is compile-validated (fix_build.log).

## Negative results recorded alongside (pass-2 depth)

Checklist item kills: LinkLevel i<=count walk is bounded (pcie count clamped to <=7 at smu7_hwmgr.c:561-569); mc_reg-table walks are not in this file (smu7_smumgr.c owns them); fan-table div0 is known DF-1345; VCE/UVD count overflow is known DF-1346; Smio[32] and SmioTable.Pattern[4] walks are correctly clamped (SMU_MAX_SMIO_LEVELS).

## Fix

Read entries[level] in the MVDD pattern loop and bound the populate_mvdd_value walk by PP_ATOMCTRL_MAX_VOLTAGE_ENTRIES (fix.diff). Applied and compile-validated on the guest (fix_build.log); sys/ tree never modified by the audit.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.