{
  "finding_id": "DF-4072",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-level certain, hardware-gated. In vegam_get_dependency_volt_by_clk(), when the requested clock exceeds every table entry the for-loop exits with i == dep_table->count, and line 661 reads dep_table->entries[i].mvdd -- exactly one record past the kzallocd count-record table (process_pptables_v1_0.c allocates sizeof + count*sizeof(record) exactly). One-record heap OOB read (2-byte mvdd field) whose value is only used as a boolean; the value actually programmed comes from entries[i-1]. Sibling of the polaris/fiji off-by-ones; hit on every above-max clock query (ACPI level with boot sclk above table max, etc.).",
  "exploit_chain": "",
  "evidence": "vegam_smumgr.c:614-642 loop, :645 entries[i-1] (correct), :661 entries[i] with i==count (OOB read)",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:661",
    "sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:645",
    "sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:389"
  ],
  "poc_changes": "n/a (source-level)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a (source-level finding)",
  "run_cmd": "n/a (hardware-gated; source-level analysis)",
  "code_hash": null,
  "notes": "Low impact: boolean use of an OOB-read u16; wrong-MVDD programming at worst.",
  "recommended_fix": "Use dep_table->entries[i - 1].mvdd at line 661.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Hardware-gated finding (no AMD VegaM GPU / no LSI mps controller on the audit guest): fix authored at source level (fix.diff) but not build/boot-validated.",
  "fix_evidence": "fix.diff in this pack; authored post-analysis, not hardware-validated."
}