# DF-4169 VERDICT (verify run, 2026-10-15)

**Status: REPRODUCED (verbatim-rig evidence class). Every defect the
finding enumerates was demonstrated in byte-identical production code —
the NULL WRITE at NULL+0x30 exactly as filed, two more NULL reads, the
literal `levels[0xFFFFFFFF]` wild reads (~64 GB) from `level==0`, and the
`smu8_get_performance_level` clamp-defeat OOB read — and the pack's
fix.diff was A/B-validated in the same rig: fixed (all guarded modes
return -EINVAL, clean-valid byte-identical). In-kernel execution is
AMD-ASIC-gated on this guest (no AMD GPU — proven, `env.txt`).**

## 1. Method

The guest cannot attach amdgpu (0 vendors 0x1002, no `/dev/dri`). Following
the DF-4165/4247/4388/4396 evidence class, the **actual production
functions** were compiled into a guest-side harness:

- `rig/gen_rig.sh` extracts the cited smu8_hwmgr.c functions byte-identical:
  :49-97 (smu8_magic, `cast_smu8_power_state`, `cast_const_smu8_power_state`,
  `smu8_get_eclk_level`), :99-127, :129-158 (level helpers),
  :248-252 (`smu8_convert_8Bit_index_to_voltage`),
  **:1037-1080 `smu8_apply_state_adjust_rules`**, :1251-1278,
  **:1303-1322 `smu8_dpm_get_sclk`**, **:1556-1593
  `smu8_get_performance_level`**, **:1595-1604
  `smu8_get_current_shallow_sleep_clocks`**, :1846-1874 — plus 16 header
  slices (power_state.h 26-187, hardwaremanager.h caps/platform descriptor/
  PP_Clocks/PHM_PerformanceLevel, hwmgr.h magic enum + dependency tables,
  smu8_hwmgr.h state structs, cz_ppsmc.h message ids, kgd_pp_interface.h
  forced-level enum).
- `rig/check_verbatim.sh` re-verified all 26 blocks **byte-identical — run
  on the guest against `/usr/src/sys`, the tree its running kernel was
  compiled from** (`build.log`: `ALL VERBATIM CHECKS PASSED`; guest
  /usr/src smu8_hwmgr.c md5 a0cb59b723434a78e88bf0580d5a5508 == repo).
- The fixed build is the same functions **+ exactly this pack's fix.diff**
  (applied to a copy of the pristine full file with `patch --fuzz=0`;
  proven bidirectionally: forward apply no rejects, reverse apply restores
  the pristine file byte-exactly; the rig applies a header-normalized copy
  whose hunk bodies are `cmp`-identical to the pack's fix.diff — only the
  `---`/`+++` path lines differ, checker-proven).
- Harness shims (`rig/rig_shims.h`) touch no defect path: recording shims
  for `smum_send_msg_to_smc_with_parameter` / `smu8_nbdpm_pstate_enable_\
  disable` / `smu8_enable_disable_uvd_dpm`; minimized `struct pp_hwmgr` /
  `phm_dynamic_state_info` / `smu8_hwmgr` /
  `amd_pp_display_configuration` with production names/types for every
  field the functions and the fix consult; power states allocated exactly
  as pp_psm.c does (kzalloc ⇒ ZEROED, size = sizeof(pp_power_state) +
  sizeof(smu8_power_state) — the production ps_size formula), VCE/UVD
  tables exactly as processpptables.c does. Allocations are guard-backed:
  end-anchored (first byte past the object faults) and lead-guard (first
  byte before the object faults); the fault classifier prints address,
  READ/WRITE (x86 #PF error bit from `mc_err`), and the class.

## 2. Observed (run.log; byte-identical in run.2.log/run.3.log, md5-equal)

Layout: `need_dfs_bypass` at **offset 0x30** (48) — the finding's cited
offset, confirmed; `action` at 0x40; `levels` at 68; smu8_power_level=16B;
`levels[0xFFFFFFFF]` = state+0x1000000034 (**64.0 GB**).

**Baseline — verbatim production code, per finding site:**

| mode | observation | verbatim site |
|---|---|---|
| 4169-boot-chain | psm loop over a 2-state VBIOS with **no Boot flag** leaves request_ps/current_ps magic=0 (kzalloc'd, never memcpy'd); first `smu8_dpm_get_sclk` → **SIGSEGV READ at NULL+0x4** (`smu8_ps->level` through the NULL cast) | :1316→:1321; chain pp_psm.c:53-94 |
| 4169-boot-chain-control | same VBIOS WITH one Boot state → magic stamped, `get_sclk(high)=60000`, no fault — the precondition is exactly the Boot flag | pp_psm.c:89-94 |
| 4169-null-adjust-rules | **SIGSEGV WRITE at NULL+0x30** — `smu8_ps->need_dfs_bypass = true` through the NULL cast (exactly the filed "NULL at offset 0x30") | :1041/:1044 → :1051 |
| 4169-null-get-sclk | **SIGSEGV READ at NULL+0x44** — `smu8_ps->levels[0].engineClock` | :1316 → :1319 |
| 4169-level0-get-sclk | magic-valid state with `level==0` → **read at state+68719476900 (~64 GB)** = `levels[level-1]` = `levels[0xFFFFFFFF]` (uint32 wrap) | :1321 |
| 4169-level0-perf-unclamped | `level==0` defeats the :1571 clamp (`9 > 0xFFFFFFFF` false) → `levels[9]` read **324 B past the end of the 320 B state allocation** (12 B past the smu8 tail) | :1571-1572 |
| 4169-level0-shallow-sleep | **read at state+68719476906 (~64 GB)** — literal `ps->levels[ps->level - 1]` with level==0 | :1601 |
| clean-valid | all five functions on a valid 2-level state: rc=0, values exactly as computed (get_sclk 30000/60000, vddc 1525, msgs [0x20,0x1]/[0x1c,0x1]) | — |

**Fixed (this pack's fix.diff, identical inputs):** every 4169 mode
returns `-EINVAL` (rc=-22; get_sclk returns it through its uint32_t return
as 4294967274) **without faulting**; boot-chain still returns no clock but
no NULL deref; clean-valid output **byte-identical** to baseline. The two
DF-4171 modes still fault under this fix (orthogonality, see DF-4171's
pack). Fix A/B validated.

## 3. Primitive and impact

1. **Kernel NULL-page WRITE** (`:1051`, NULL+0x30) and NULL reads
   (`:1066` NULL+0x40 via `smu8_current_ps->action`, `:1319` NULL+0x44):
   kernel-mode fault on the unmapped null page ⇒ **fatal trap ⇒ kernel
   panic**. Impact class: panic (local DoS), exactly as filed.
2. **Wild ~64 GB reads** (`levels[0xFFFFFFFF]`, :1321/:1601): guaranteed
   unmapped in kernel space ⇒ fatal trap ⇒ panic. (Not an info leak: the
   value would have to be mapped and returned; the fault is the outcome.)
3. **OOB read past the power-state allocation** (:1571-1572 clamp defeat):
   reads adjacent kernel heap (up to `index` unclamped) into
   `level->coreClock` — a PHM_PerformanceLevel that sysfs/DPM queries
   return to userland; a bounded heap over-read with a userland-visible
   sink in-kernel (in the rig: guard-detected at +324/+320).

Threat model (family's established one): crafted/corrupted GPU VBIOS
(Carrizo/Bristol Ridge SMU8 — the `smu8_hwmgr.c` hwmgr binds to CZ APUs)
parsed at driver attach, or root re-parsing a crafted blob via
`/sys/class/drm/card0/device/pp_table`. No unprivileged userland trigger
on stock hardware — same class as DF-4143/4247. Demonstrated
out-of-kernel context (rig); the in-kernel consequence (NULL write ⇒
panic) follows from the verbatim instruction stream.

## 4. Fix validation

`rig_fixed` = same verbatim slice + this pack's fix.diff (checker-proven
identity, bidirectional patch proof). All 4169 modes: **no fault** —
guards return -EINVAL for NULL casts and level==0; clean-valid:
**byte-identical** to baseline. The 4171 modes faulting under this build
prove the two findings' fixes are orthogonal and that the 4169 modes are
not artifacts. A rebuilt-kernel validation was not performed: the fix
sites execute in-kernel only on AMD ASICs absent from this guest; per the
verbatim-rig protocol the fixed slice was A/B-validated in the same rig.
`fix.diff` is authored against the pristine read-only `sys/` tree and was
never applied there (guest `/usr/src` verified pristine by md5 before and
after: a0cb59b723434a78e88bf0580d5a5508).

## 5. Honest limitations

- Demonstrated with production instructions and production struct layouts
  in a userland mapping, not the kernel heap; the harness builds the
  precondition (zeroed/level-0 states) directly rather than by parsing a
  full crafted ATOM ROM (the psm loop that produces the zeroed
  request_ps/current_ps is harness-reimplemented from pp_psm.c:76-95 and
  driven with/without the Boot flag — the control run isolates the
  precondition exactly).
- `smu8_dpm_get_sclk` returns uint32_t, so the fixed build's -EINVAL is
  observable as 4294967274 (production return-type quirk; callers at this
  call site only log/format the value).
- The finding's summary attributes the `levels[0xFFFFFFFF]` underflow to
  `get_performance_level`; measured, :1571 in that function manifests as
  **clamp defeat** (unclamped `levels[index]` OOB), while the literal
  `levels[level-1]` 0xFFFFFFFF wrap occurs at :1321 and :1601. Both
  variants demonstrated; both covered by the fix's `level == 0` guards.

## 6. Bottom line

The finding is verified end to end: the four unchecked cast sites and the
level==0 arithmetic reproduce in byte-identical production code at the
exact filed offsets (NULL+0x30 WRITE, NULL+0x4/0x40/0x44 reads, ~64 GB
wild reads, clamp-defeat OOB read), the precondition (no Boot-classified
state ⇒ zeroed request_ps/current_ps) is isolated by a control run, and
the pack's fix.diff neutralizes every demonstrated mode on identical
input while leaving valid-state behavior byte-identical.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.