{
  "finding_id": "DF-4054",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Hardware-gated (guest has no AMD GPU; vega12_hwmgr never runs), so the driver path is inconclusive at runtime \u2014 but the defect is source-certain and line-verified: vega12_get_number_of_dpm_level stores a raw SMU-firmware-fed uint32 (smum_get_argument) with only a >0 check (vega12_hwmgr.c:481) into dpm_table->count (:518), and the fill loop writes dpm_levels[i] for i < num_of_levels (:520-527) past dpm_levels[MAX_REGULAR_DPM_NUMBER=16] (vega12_hwmgr.h:107-110) \u2014 a firmware-controlled linear heap overflow of the kzallocd struct vega12_hwmgr backend (12-byte stores, firmware-chosen values), marching through all ten dpm tables and past the allocation. A struct-geometry replica (trigger.c, built and run on the guest) shows 100 levels -> 54 bytes past a 636-byte object plus the entry-16 enabled store smashing the next tables count. vega12_find_highest_dpm_level:989 already asserts count<=16, proving the missing enforcement. Fix (reject counts > MAX_REGULAR_DPM_NUMBER at :481) compile-validated in the batched kernel build.",
  "exploit_chain": "",
  "evidence": "run.log (replica output: bytes written past end of object (guard band): 54 <-- HEAP OVERFLOW and gfx_table.count = 0x00000001 from entry 16s enabled store), build.log (guest cc 8.3), fix_build.log (batched nativekernel RC=0, kernel #1), VERDICT.md line-accurate walk",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.c:480",
    "sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.c:481",
    "sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.c:518",
    "sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.c:520",
    "sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.c:525",
    "sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.c:989",
    "sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.h:96",
    "sys/dev/drm/amd/powerplay/hwmgr/vega12_hwmgr.h:107",
    "sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:479"
  ],
  "poc_changes": "No seed existed; trigger.c is a struct-geometry replica of the fill loop using the exact vega12_hwmgr.h types (compiled on the guest \u2014 the audit host has no compiler).",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 95,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -Wall -o /tmp/df4054_trigger /tmp/df4054_trigger.c",
  "run_cmd": "/tmp/df4054_trigger 20; /tmp/df4054_trigger 100",
  "code_hash": "863f71e3eb45ce27f3702bb3e15629dadd36214440da7fc0432265747203fdbb",
  "notes": "Hardware-gated per audit convention for smumgr/hwmgr firmware-fed findings (cf. DF-3909/DF-4001). vega20_hwmgr.c:466-485 is an unfixed twin (separate file, future batch).",
  "recommended_fix": "Reject impossible SMU level counts at the boundary: PP_ASSERT_WITH_CODE(*num_of_levels <= MAX_REGULAR_DPM_NUMBER, ..., return -EINVAL); in vega12_get_number_of_dpm_level.",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix compile-validated only (batched with DF-4053 in the kernel #1 build, RC=0); runtime A/B impossible on this guest \u2014 no Vega12 hardware, baseline never reproducible here either.",
  "fix_evidence": "fix_build.log (nativekernel completed RC=0, installkernel completed, uname #1 running both fixes)"
}