# DF-4128 — Ignored rv6xx_convert_clock_to_stepping failures leave uninitialized stepping structs programmed into the SPLL; unbounded step index overruns the SPLL step register block

- File: sys/dev/drm/radeon/rv6xx_dpm.c
- Lines: 249-250,302-304,293   Severity: Low   Confidence: likely
- Status: inconclusive (impact: none) — hardware-gated crafted-VBIOS/firmware threat model;
  source-level certainty, no GPU in guest.

## Summary
rv6xx_generate_steps() ignores the return of
rv6xx_convert_clock_to_stepping() at rv6xx_dpm.c:249-250 (and
rv6xx_generate_single_step() at :302). On failure
(rv6xx_convert_clock_to_stepping returns early at :147-148 before writing
`step`) the caller's `cur`/`target` struct rv6xx_sclk_stepping remain
UNINITIALIZED stack — radeon_atom_get_clock_dividers memsets only its own
dividers struct (radeon_atombios.c:2838), not the stepping. The garbage
post_divider/vco_frequency are then programmed into hardware through
rv6xx_output_stepping (:174-190), and rv6xx_can_step_post_div (:210-217)
with a garbage post_divider spins decrementing up to ~4e9 times under
pm.mutex. Separately, even with valid conversions the stepping count is
driven by the VBIOS-controlled SCLK range (low..high are power-table
usEngineClock values): ~ln(high/low)/ln(1.2) steps (+20% per step,
R600_VCOSTEPPCT_DFLT=20), easily >100 for extreme clock ranges, while the
SPLL step register block at SCLK_FREQ_SETTING_STEP_0_PART1/2 (0x648/0x64c,
r600_dpm.c:450,461,468,472,479,482,486,489,493,496,500-504 — stride 8) has
only ~0xB0/8 = 22 entries before VID_RT (0x6f8, r600d.h:1374): the writes
run past the step table into VID_RT, CTXSW_PROFILE_INDEX,
TARGET_AND_CURRENT_PROFILE_INDEX etc. (MMIO misconfiguration of unrelated
blocks from crafted-VBIOS data).

## Reproduce
No runnable kernel PoC: requires RV6xx/i915 hardware. See VERDICT.md for the full line-by-line source trace and fix.diff for the validated patch.

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64