# DF-4073 VERDICT — source-level certain, hardware-gated

## Site 1 — wrong loop index (uninitialized slot read)
vegam_populate_smc_mvdd_table() (:458-466) reads
    data->mvdd_voltage_table.entries[count].value
inside `for (level = 0; level < count; level++)` — the index must be `level`, not `count`.
In-bounds (entries[PP_ATOMCTRL_MAX_VOLTAGE_ENTRIES=32], count clamped to SMU_MAX_SMIO_LEVELS=4 —
ppatomctrl.h:45,211; smu75.h:53) but it reads an UNINITIALIZED slot and programs the SAME garbage
voltage into every SmioTable2.Pattern[level].Voltage ⇒ MVDD DPM misprogramming (hardware behavior).

## Site 2 — cross-table index (true heap OOB read)
vegam_populate_mvdd_value() (:1093-1097) walks `table_info->vdd_dep_on_mclk` (count up to 255,
VBIOS u8) and on the first matching entry reads
    data->mvdd_voltage_table.entries[i].value
— indexing the MVDD table by the MCLK-dependency position. mvdd_voltage_table.entries capacity is
32; for i >= 32 (reachable when dep entries with clk < mclk precede the match — a reordered/crafted
table) this reads up to ~2.5 KB past entries[] inside the struct smu7_hwmgr heap object, and the
value is programmed as a voltage (vegam_populate_smc_acpi_level:1177-1186).

## Fixes
entries[count] -> entries[level] at :460; at :1095 validate/bound i against
mvdd_voltage_table.count before use.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.