# DF-4072 VERDICT — source-level certain, hardware-gated

## Root cause
- vegam_get_dependency_volt_by_clk() searches `for (i = 0; i < dep_table->count; i++)` for the first
  entry with clk >= clock (vegam_smumgr.c:614-642). When the clock exceeds every entry, the loop
  exits with i == dep_table->count.
- The tail path then uses entries[i-1] correctly at :645/:653, but the MVDD predicate at :661 reads
  `dep_table->entries[i].mvdd` — i == count ⇒ exactly ONE RECORD past the allocation.
- Allocation: process_pptables_v1_0.c:381-389 (mclk) and :425-470 (sclk) kzalloc exactly
  `sizeof(count field) + count * sizeof(record)` — entries[count] is genuinely past the heap object.

## Impact
2-byte OOB heap read used as a boolean; if it happens to be nonzero the code then programs
entries[i-1].mvdd (in-bounds). Worst realistic effect: wrong MVDD selection + an OOB read that can
fault at a slab boundary. Hit on every "clock above table max" query (e.g. ACPI level with boot
clock above the dependency table's max — vegam_populate_smc_acpi_level:1125/1163).

## Fix
`dep_table->entries[i].mvdd` -> `dep_table->entries[i - 1].mvdd` at :661.
Sibling pattern of the fiji/polaris off-by-ones filed in pass 2 (DF-40xx series).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.