{
  "finding_id": "DF-4071",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-level certain, hardware-gated. vegam_program_memory_timing_parameters() declares struct SMU75_Discrete_MCArbDramTimingTable arb_regs ON THE KERNEL STACK (640B: entries[8][4] of 20B) and fills arb_regs.entries[i][j] with i < sclk count, j < mclk count -- both straight unclamped VBIOS u8 counts. sclk count=9 alone writes at byte offset 820 of the 640B object (180B past it); sclk count=255 walks 20,400B past -- a kernel STACK overflow with MMIO-register-derived (semi-controlled) 20B records, adjacent to the caller frame in vegam_init_smc_table -> return-address smashing shape. Distinct from DF-1368 (which enumerated cac_table :515, clock_stretcher :1515, avfs :1636 only).",
  "exploit_chain": "",
  "evidence": "run.log: sizeof(SMU75_Discrete_MCArbDramTimingTable)=640; sclk=9 -> offset 820; sclk=255 -> 20400; smu75_discrete.h:191-192 (entries[SMU__NUM_SCLK_DPM_STATE=8][SMU__NUM_MCLK_DPM_LEVELS=4])",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:1291",
    "sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:1297",
    "sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:1302",
    "sys/dev/drm/amd/powerplay/inc/smu75_discrete.h:192"
  ],
  "poc_changes": "n/a (source-level; sizes from guest probe run.log)",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 2,
  "guest_dirty": 0,
  "build_cmd": "cd /tmp && cc -I/usr/src/sys/dev/drm/amd/powerplay/inc -o probe probe.c",
  "run_cmd": "./probe",
  "code_hash": "f7a1c2a04508804db37b7fac0f9eed0a292e293a9b7a26d975c9dc3d8939ca76",
  "notes": "Called at init (vegam_init_smc_table:1991) and on every OD sclk/mclk table update via vegam_update_sclk_threshold -> vegam_program_mem_timing_parameters (:2204-2212).",
  "recommended_fix": "Clamp i-loop to SMU__NUM_SCLK_DPM_STATE and j-loop to SMU__NUM_MCLK_DPM_LEVELS.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Hardware-gated finding (no AMD VegaM GPU / no LSI mps controller on the audit guest): fix authored at source level (fix.diff) but not build/boot-validated.",
  "fix_evidence": "fix.diff in this pack; authored post-analysis, not hardware-validated."
}