{
  "finding_id": "DF-4170",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "smu8_upload_pptable_to_smu dereferences vdd_gfx/acp/uvd/vce dependency-table pointers (smu8_hwmgr.c:443-452 -> :465-474 and the fill loop :476-547) that processpptables.c:1210-1265 only constructs when the corresponding VBIOS extension offset is non-zero; each stays NULL otherwise. A VBIOS omitting any of those tables panics the driver at load with a page-0 read of ->count. Distinct tables/sites from DF-1419 (vddc table at :259-265, which crashes first only for the vddc case).",
  "exploit_chain": "Hardware attacker model only: crafted VBIOS on AMD hardware (flashed ROM / vfio romfile). No userland-triggerable chain on the audit guest - path hardware-gated.",
  "evidence": "VERDICT.md (root cause, line-accurate), README.md (trigger math), env.txt (guest hardware-gating proof: pciconf/sysctl/uname), fix.diff (source-authored, git-apply-able, not build-validated).",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:465",
    "sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c:469",
    "sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:1210",
    "sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:1231"
  ],
  "poc_changes": "None - no seeded PoC sources existed for these pass-2 findings; packs built fresh.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:52:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 25,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": "86c1667e84c25fd4eaffdea1821ac505322cb70ffa701dc20599f6ad2ce43530",
  "notes": "Hardware-gated: audit QEMU guest has no AMD GPU (pciconf shows only bochs SVGA 0x1234:1111; sysctl dev.drm unknown; no amdgpu binding - see env.txt). The audited code path (DC bios_parser2 / smu8 powerplay) never executes on this guest; reproduction requires a DCE12-class ASIC / KV-CZ APU with a crafted VBIOS (flashed ROM or vfio romfile override), which is the stated attacker model. poc status untested per persist_poc enum (hardware-gated; equivalent to not_testable). fix.diff authored from line-accurate source confirmation; fix build/validation impossible without the hardware.",
  "recommended_fix": "Reject powerplay-table upload (-EINVAL) when any of the five dependency tables is missing.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix authored from source analysis only: Reject powerplay-table upload (-EINVAL) when any of the five dependency tables is missing. Baseline/patched kernels could not be exercised on the audit guest (no AMD GPU), so fix validation is not_testable rather than fixed.",
  "fix_evidence": "fix.diff in this pack (unified diff generated against the pristine sys/ tree)."
}