{
 "finding_id": "DF-4070",
 "status": "inconclusive",
 "reproduced": 0,
 "impact": "none",
 "confidence": "certain",
 "verdict": "Source-level certain, hardware-gated. vegam_populate_all_memory_levels() walks dpm_table.mclk_table.count (unclamped VBIOS u8 count) writing levels[i] into MemoryLevel[SMU75_MAX_LEVELS_MEMORY=4] (32B each, 128B capacity, offset 748). count=5 is ALREADY OOB (32B past the array into LinkLevel[0]); count=255 writes 8,160B => far past the 1956B DpmTable and the vegam_smumgr allocation. The bar is lower than the SCLK walk (4 vs 8). The [count-1] store at :1073 was checked and is NOT underflowable: both smu7 setup paths assert dep-mclk count >= 1 and return -EINVAL. Hardware-gated (crafted VBIOS pptable on a VegaM SKU).",
 "exploit_chain": "",
 "evidence": "run.log: sizeof(SMU75_Discrete_MemoryLevel)=32, capacity 4*32=128B; count=5 -> byte 160 (OOB); count=255 -> 8160B; smu75_discrete.h:289",
 "kernel_refs": [
  "sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:1047",
  "sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:1064",
  "sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:1073",
  "sys/dev/drm/amd/powerplay/inc/smu75_discrete.h:289",
  "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:704"
 ],
 "poc_changes": "n/a (source-level; sizes from guest probe run.log)",
 "attempts": 2,
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runtime_sec": 2,
 "guest_dirty": 0,
 "build_cmd": "cd /tmp && cc -I/usr/src/sys/dev/drm/amd/powerplay/inc -o probe probe.c",
 "run_cmd": "./probe",
 "code_hash": "f7a1c2a04508804db37b7fac0f9eed0a292e293a9b7a26d975c9dc3d8939ca76",
 "notes": "MemoryDpmLevelCount u8 cast at :1064 cannot truncate (u8-sourced count). Negative checked: levels[count-1] guarded by >=1 asserts in smu7_hwmgr.c:704-707 and :793-796.",
 "recommended_fix": "Clamp the MCLK level walk and MemoryDpmLevelCount to SMU75_MAX_LEVELS_MEMORY.",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "Hardware-gated finding (no AMD VegaM GPU / no LSI mps controller on the audit guest): fix authored at source level (fix.diff) but not build/boot-validated.",
 "fix_evidence": "fix.diff in this pack; authored post-analysis, not hardware-validated."
}