{
  "finding_id": "DF-4073",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Two wrong-index MVDD stash reads (checklist class g). (1) vegam_populate_smc_mvdd_table():459-460 reads data->mvdd_voltage_table.entries[count] inside a loop over level -- should be entries[level]. In-bounds (entries[32], count clamped to SMU_MAX_SMIO_LEVELS=4) but it reads an uninitialized slot and programs the SAME garbage MVDD voltage into every SmioTable2.Pattern[level]. (2) vegam_populate_mvdd_value():1095 indexes data->mvdd_voltage_table.entries[i] with i from a DIFFERENT table (vdd_dep_on_mclk, count up to 255) while the mvdd tables entries capacity is 32 => for i >= 32 a true heap OOB read inside struct smu7_hwmgr, value programmed as a voltage. Hardware-gated (crafted VBIOS).",
  "exploit_chain": "",
  "evidence": "vegam_smumgr.c:458-465 (entries[count] vs loop index level); :1093-1097 (mvdd_voltage_table.entries[i] indexed by vdd_dep_on_mclk position); ppatomctrl.h:45,211 (entries[32])",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:459",
    "sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:1095",
    "sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.h:211"
  ],
  "poc_changes": "n/a (source-level)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a (source-level finding)",
  "run_cmd": "n/a (hardware-gated; source-level analysis)",
  "code_hash": null,
  "notes": "Part (1) matches the upstream Linux vegam wrong-index pattern (fixed there as entries[level]).",
  "recommended_fix": "entries[count] -> entries[level] at :460; at :1095 bound/validate i against mvdd_voltage_table.count (or index by mvdd table lookup).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Hardware-gated finding (no AMD VegaM GPU / no LSI mps controller on the audit guest): fix authored at source level (fix.diff) but not build/boot-validated.",
  "fix_evidence": "fix.diff in this pack; authored post-analysis, not hardware-validated."
}