# DF-4069 VERDICT — source-level certain, hardware-gated (not reproducible on audit guest)

## Root cause (path:line)
- `vegam_populate_all_graphic_levels()` loops `for (i = 0; i < dpm_table->sclk_table.count; i++)`
  writing `smc_state_table.GraphicsLevel[i]` — vegam_smumgr.c:886-901, second pass 911-913 and 920-922.
- Destination: `SMU75_Discrete_GraphicsLevel GraphicsLevel[SMU75_MAX_LEVELS_GRAPHICS=8]`
  — smu75_discrete.h:287 (offset 236 in the 1956-byte SMU75_Discrete_DpmTable, member of
  kzalloc'd `struct vegam_smumgr`, vegam_smumgr.h:66).
- Count provenance: VBIOS `ucNumEntries` (u8) — process_pptables_v1_0.c:425-470 (asserted !=0 only),
  copied 1:1 into `dpm_table.sclk_table.count` by smu7_hwmgr.c:689-697 / 783-810 (count++ per distinct
  clk, NO clamp). Nothing between the parser and this loop clamps to 8.

## Proof (guest-compiled probe, exact numbers from the in-tree headers; run.log)
- sizeof(SMU75_Discrete_GraphicsLevel) = 60 → capacity 480 B.
- count=9 → first OOB write (offset 236+540 = 776, into MemoryACPILevel).
- count=255 → 255*60 = 15,300 B from offset 236 ⇒ ends ~13 KB past the entire vegam_smumgr heap object
  (slab-adjacent overwrite; writes are SMU register constants + VBIOS-derived fields).

## Why not reproduced
Audit guest has no AMD VegaM GPU; the DRM powerplay path cannot execute. Per honest-status table this is
hardware-gated: status=inconclusive, impact=none, confidence=certain (source).

## Negative checks done
- `GraphicsDpmLevelCount = (uint8_t)count` (:906) — no truncation possible (count is u8-sourced).
- Not covered by knowns: DF-1366/67/68 = VCE/UVD/CAC/clock-stretcher/AVFS walks only.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.