# DF-4071 VERDICT — source-level certain, hardware-gated

## Root cause
- `vegam_program_memory_timing_parameters()` puts `struct SMU75_Discrete_MCArbDramTimingTable arb_regs`
  ON THE STACK (vegam_smumgr.c:1291; 640B total = entries[SMU__NUM_SCLK_DPM_STATE=8][SMU__NUM_MCLK_DPM_LEVELS=4]
  of 20B records — smu75_discrete.h:191-192) and fills `arb_regs.entries[i][j]` with
  i < sclk_table.count and j < mclk_table.count (:1297-1302) — both unclamped VBIOS u8 counts
  (same provenance as DF-4069/4070).
- sclk count = 9 alone writes 20B at byte 820 of the 640B object (180B past its end);
  sclk count = 255 ⇒ byte 20,400 ⇒ ~20 KB past a 640-byte KERNEL STACK object, in the frame of
  vegam_program_memory_timing_parameters called from vegam_init_smc_table (:1991) and on every
  OD sclk/mclk table update (:2204-2212 ⇒ vegam_update_sclk_threshold).
- Written content: 5 x 32-bit MC-arb register values read from MMIO (attacker-influenced via the
  crafted clocks fed to atomctrl) — a stack-smashing shape (return address / adjacent frames).

## Distinct from knowns
DF-1368 enumerated ONLY cac_table (:515), clock_stretcher (:1515), avfs (:1636) — the MC-arb walk
at :1287-1315 is none of those three functions (pass-1's broad 515-1642 line range notwithstanding,
its summary names the covered walks).

## Why not reproduced
No VegaM GPU on the audit guest; probe (run.log) proves the struct sizes.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.