# DF-4070 VERDICT — source-level certain, hardware-gated

## Root cause
- `vegam_populate_all_memory_levels()` loops `i < dpm_table->mclk_table.count` writing `levels[i]`
  — vegam_smumgr.c:1047-1062 (and 1069-1071) into `MemoryLevel[SMU75_MAX_LEVELS_MEMORY=4]`
  (smu75_discrete.h:289; 32B entries, capacity 128B at offset 748 of the 1956B DpmTable).
- mclk_table.count = VBIOS u8 ucNumEntries via smu7_hwmgr.c:704-712 / 799-810 — unclamped.
- LOWER BAR THAN THE SCLK TWIN (DF-4069): any pptable with >= 5 MCLK dep entries overflows
  (5*32=160 > 128): 32B past the array into LinkLevel[0]. count=255 ⇒ 8,160B ⇒ far past the whole
  vegam_smumgr allocation.

## Negative checked (NOT a bug)
- `levels[dpm_table->mclk_table.count - 1].DisplayWatermark = ...` (:1073): count==0 would index
  0xFFFFFFFF, but both smu7 setup paths assert dep-mclk count >= 1 and return -EINVAL
  (smu7_hwmgr.c:704-707 and :793-796) before vegam ever runs. No underflow.
- `MemoryDpmLevelCount = (uint8_t)count` (:1064): no truncation (u8-sourced).

## Why not reproduced / probe evidence
No VegaM GPU on guest; probe (run.log) proves the exact capacities cited above.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.