################ BASELINE (verbatim production code) ################
===== [BASELINE] MODE layout =====
  sizeof(struct pp_power_state)      = 120
  sizeof(struct smu8_power_state)    = 200
  offsetof(smu8_power_state, need_dfs_bypass) = 48 (0x30) <- :1051 first NULL write
  offsetof(smu8_power_state, action)          = 64 (0x40) <- :1066 NULL read
  offsetof(smu8_power_state, levels)          = 68
  sizeof(struct smu8_power_level)    = 16
  levels[0xFFFFFFFF] byte offset     = 0x1000000034 (64.0GB) <- :1321/:1601 when level==0
  sizeof(phm_vce_clock_voltage_dependency_table) = 16, offsetof(entries) = 4, sizeof(record) = 12
  vce entries[count-1] with count==0 (uint8_t -> int -1): table + 4 - 12 = table - 8
  uvd entries[count-1] likewise:      table - 8
  load-time guard (:471-474): count=0 <= SMU8_MAX_HARDWARE_POWERLEVELS=8 -> PASSES (0 accepted)
  smu8_magic = 0x67dcba25
----- exit=0 -----
===== [BASELINE] MODE 4169-boot-chain =====
  VBIOS power states parsed: 2, Boot-classified: NONE
  after psm_init_power_table: request_ps magic=0x0 current_ps magic=0x0
  calling verbatim smu8_dpm_get_sclk(high): cast returns NULL (magic 0 != 0x67dcba25); :1321 first reads smu8_ps->level at NULL+4, then indexes levels[level-1]
  (cast result would be 0x800475f30 for a stamped state)
  !! SIGSEGV (addr=0x4, READ) while: smu8_dpm_get_sclk (sysfs clock query path)
  => NULL DEREF: READ at NULL+0x4 through a cast that returned NULL (magic mismatch)
----- exit=88 -----
===== [BASELINE] MODE 4169-boot-chain-control =====
  VBIOS power states parsed: 2, Boot-classified: YES (state 1)
  after psm_init_power_table: request_ps magic=0x67dcba25 current_ps magic=0x67dcba25
  smu8_dpm_get_sclk(high) = 60000 (levels[1].engineClock) -- NO fault
----- exit=0 -----
===== [BASELINE] MODE 4169-null-adjust-rules =====
  request_ps magic=0x0 current_ps magic=0x0 (both kzalloc'd zeroed, never Boot-memcpy'd)
  calling verbatim smu8_apply_state_adjust_rules: :1051 smu8_ps->need_dfs_bypass = true -> write at NULL+0x30
  !! SIGSEGV (addr=0x30, WRITE) while: smu8_apply_state_adjust_rules (power-state transition)
  => NULL DEREF: WRITE at NULL+0x30 through a cast that returned NULL (magic mismatch)
----- exit=88 -----
===== [BASELINE] MODE 4169-null-get-sclk =====
  request_ps magic=0x0; calling smu8_dpm_get_sclk(low): :1319 reads smu8_ps->levels[0].engineClock at NULL+0x44
  !! SIGSEGV (addr=0x44, READ) while: smu8_dpm_get_sclk (sysfs clock query path)
  => NULL DEREF: READ at NULL+0x44 through a cast that returned NULL (magic mismatch)
----- exit=88 -----
===== [BASELINE] MODE 4169-level0-get-sclk =====
  request_ps magic=0x67dcba25 level=0; :1321 reads levels[level-1] = levels[0xFFFFFFFF] at state+0x1000000034 (~64GB away)
  !! SIGSEGV (addr=0x1800475f64, READ) while: smu8_dpm_get_sclk(high) with level==0
  => fault 68719476900 bytes from the state base 0x800475ec0 (~64GB away): WILD levels[0xFFFFFFFF]-STYLE READ (level==0 underflow)
----- exit=88 -----
===== [BASELINE] MODE 4169-level0-perf-unclamped =====
  state magic=0x67dcba25 level=0, allocation = sizeof(pp_ps)+sizeof(smu8_ps) = 120 + 200
  :1571 clamp `index > level-1 ? level-1 : index` becomes `9 > 0xFFFFFFFF ? ... : 9` -> level_index=9 (UNCLAMPED)
  :1572 reads levels[9].engineClock at state+0xd4 -- past the 200B smu8 tail
  !! SIGSEGV (addr=0x800476004, READ) while: smu8_get_performance_level(index=9) with level==0
  => fault 324 bytes PAST THE END of the 320B object: OUT-OF-BOUNDS READ past the allocation (unclamped levels[index])
----- exit=88 -----
===== [BASELINE] MODE 4169-level0-shallow-sleep =====
  state magic=0x67dcba25 level=0; :1601 reads levels[ps->level - 1] = levels[0xFFFFFFFF] (~64GB away)
  !! SIGSEGV (addr=0x1800475f6a, READ) while: smu8_get_current_shallow_sleep_clocks with level==0
  => fault 68719476906 bytes from the state base 0x800475ec0 (~64GB away): WILD levels[0xFFFFFFFF]-STYLE READ (level==0 underflow)
----- exit=88 -----
===== [BASELINE] MODE 4171-vce-count0 =====
  vce table=0x800476000 count=0 (raw u8 numEntries from VBIOS; 0 <= 8 passes the :473 load-time guard)
  :1261 reads entries[count-1].ecclk = entries[-1] at 0x800475ff8 (table-8, in the leading guard page)
  !! SIGSEGV (addr=0x800475ff8, READ) while: smu8_dpm_update_vce_dpm, VCE table count==0, StablePState cap
  => fault 8 bytes BEFORE the start of the 8B table object: NEGATIVE-INDEX UNDERFLOW READ (entries[count-1] with count==0)
----- exit=88 -----
===== [BASELINE] MODE 4171-uvd-count0-en-umd =====
  uvd table=0x800476000 count=0; en_umd_pstate=true (no StablePState cap needed -- the user sysfs route)
  :1857 reads entries[count-1].vclk = entries[-1] at table-8 (leading guard page)
  !! SIGSEGV (addr=0x800475ff8, READ) while: smu8_dpm_update_uvd_dpm(bgate=false), UVD table count==0, en_umd_pstate (sysfs profile_*)
  => fault 8 bytes BEFORE the start of the 8B table object: NEGATIVE-INDEX UNDERFLOW READ (entries[count-1] with count==0)
----- exit=88 -----
===== [BASELINE] MODE clean-valid =====
  apply_state_adjust_rules rc=0 need_dfs_bypass=1 action=1 battery=0
  get_sclk low=30000 high=60000
  perf_level(Activity,1) rc=0 core=60000 mem=66600 vddc=1525
  perf_level(PowerContainment,0) rc=0 core=60000 (threshold 50000 -> picks levels[1])
  shallow_sleep rc=0 min=15000 max=15000
  update_vce_dpm rc=0 hard_min_clk=300000 msgs: [0x20,0x1]
  update_uvd_dpm(bgate=false) rc=0 hard_min_clk=133300 msgs: [0x1c,0x1] uvdgate_calls=1
  clean-valid: PASS (no fault, all values as computed)
----- exit=0 -----

################ FIXED (same functions + this pack's fix.diff) ################
===== [FIXED] MODE layout =====
  sizeof(struct pp_power_state)      = 120
  sizeof(struct smu8_power_state)    = 200
  offsetof(smu8_power_state, need_dfs_bypass) = 48 (0x30) <- :1051 first NULL write
  offsetof(smu8_power_state, action)          = 64 (0x40) <- :1066 NULL read
  offsetof(smu8_power_state, levels)          = 68
  sizeof(struct smu8_power_level)    = 16
  levels[0xFFFFFFFF] byte offset     = 0x1000000034 (64.0GB) <- :1321/:1601 when level==0
  sizeof(phm_vce_clock_voltage_dependency_table) = 16, offsetof(entries) = 4, sizeof(record) = 12
  vce entries[count-1] with count==0 (uint8_t -> int -1): table + 4 - 12 = table - 8
  uvd entries[count-1] likewise:      table - 8
  load-time guard (:471-474): count=0 <= SMU8_MAX_HARDWARE_POWERLEVELS=8 -> PASSES (0 accepted)
  smu8_magic = 0x67dcba25
----- exit=0 -----
===== [FIXED] MODE 4169-boot-chain =====
  VBIOS power states parsed: 2, Boot-classified: NONE
  after psm_init_power_table: request_ps magic=0x0 current_ps magic=0x0
  calling verbatim smu8_dpm_get_sclk(high): cast returns NULL (magic 0 != 0x67dcba25); :1321 first reads smu8_ps->level at NULL+4, then indexes levels[level-1]
  (cast result would be 0x800475f30 for a stamped state)
  !! SIGSEGV (addr=0x4, READ) while: smu8_dpm_get_sclk (sysfs clock query path)
  => NULL DEREF: READ at NULL+0x4 through a cast that returned NULL (magic mismatch)
----- exit=88 -----
===== [FIXED] MODE 4169-boot-chain-control =====
  VBIOS power states parsed: 2, Boot-classified: YES (state 1)
  after psm_init_power_table: request_ps magic=0x67dcba25 current_ps magic=0x67dcba25
  smu8_dpm_get_sclk(high) = 60000 (levels[1].engineClock) -- NO fault
----- exit=0 -----
===== [FIXED] MODE 4169-null-adjust-rules =====
  request_ps magic=0x0 current_ps magic=0x0 (both kzalloc'd zeroed, never Boot-memcpy'd)
  calling verbatim smu8_apply_state_adjust_rules: :1051 smu8_ps->need_dfs_bypass = true -> write at NULL+0x30
  !! SIGSEGV (addr=0x30, WRITE) while: smu8_apply_state_adjust_rules (power-state transition)
  => NULL DEREF: WRITE at NULL+0x30 through a cast that returned NULL (magic mismatch)
----- exit=88 -----
===== [FIXED] MODE 4169-null-get-sclk =====
  request_ps magic=0x0; calling smu8_dpm_get_sclk(low): :1319 reads smu8_ps->levels[0].engineClock at NULL+0x44
  !! SIGSEGV (addr=0x44, READ) while: smu8_dpm_get_sclk (sysfs clock query path)
  => NULL DEREF: READ at NULL+0x44 through a cast that returned NULL (magic mismatch)
----- exit=88 -----
===== [FIXED] MODE 4169-level0-get-sclk =====
  request_ps magic=0x67dcba25 level=0; :1321 reads levels[level-1] = levels[0xFFFFFFFF] at state+0x1000000034 (~64GB away)
  !! SIGSEGV (addr=0x1800475f64, READ) while: smu8_dpm_get_sclk(high) with level==0
  => fault 68719476900 bytes from the state base 0x800475ec0 (~64GB away): WILD levels[0xFFFFFFFF]-STYLE READ (level==0 underflow)
----- exit=88 -----
===== [FIXED] MODE 4169-level0-perf-unclamped =====
  state magic=0x67dcba25 level=0, allocation = sizeof(pp_ps)+sizeof(smu8_ps) = 120 + 200
  :1571 clamp `index > level-1 ? level-1 : index` becomes `9 > 0xFFFFFFFF ? ... : 9` -> level_index=9 (UNCLAMPED)
  :1572 reads levels[9].engineClock at state+0xd4 -- past the 200B smu8 tail
  !! SIGSEGV (addr=0x800476004, READ) while: smu8_get_performance_level(index=9) with level==0
  => fault 324 bytes PAST THE END of the 320B object: OUT-OF-BOUNDS READ past the allocation (unclamped levels[index])
----- exit=88 -----
===== [FIXED] MODE 4169-level0-shallow-sleep =====
  state magic=0x67dcba25 level=0; :1601 reads levels[ps->level - 1] = levels[0xFFFFFFFF] (~64GB away)
  !! SIGSEGV (addr=0x1800475f6a, READ) while: smu8_get_current_shallow_sleep_clocks with level==0
  => fault 68719476906 bytes from the state base 0x800475ec0 (~64GB away): WILD levels[0xFFFFFFFF]-STYLE READ (level==0 underflow)
----- exit=88 -----
===== [FIXED] MODE 4171-vce-count0 =====
  vce table=0x800476000 count=0 (raw u8 numEntries from VBIOS; 0 <= 8 passes the :473 load-time guard)
  :1261 reads entries[count-1].ecclk = entries[-1] at 0x800475ff8 (table-8, in the leading guard page)
  rc=-22
  returned WITHOUT faulting (guard active in fixed build)
----- exit=0 -----
===== [FIXED] MODE 4171-uvd-count0-en-umd =====
  uvd table=0x800476000 count=0; en_umd_pstate=true (no StablePState cap needed -- the user sysfs route)
  :1857 reads entries[count-1].vclk = entries[-1] at table-8 (leading guard page)
  rc=-22
  returned WITHOUT faulting (guard active in fixed build)
----- exit=0 -----
===== [FIXED] MODE clean-valid =====
  apply_state_adjust_rules rc=0 need_dfs_bypass=1 action=1 battery=0
  get_sclk low=30000 high=60000
  perf_level(Activity,1) rc=0 core=60000 mem=66600 vddc=1525
  perf_level(PowerContainment,0) rc=0 core=60000 (threshold 50000 -> picks levels[1])
  shallow_sleep rc=0 min=15000 max=15000
  update_vce_dpm rc=0 hard_min_clk=300000 msgs: [0x20,0x1]
  update_uvd_dpm(bgate=false) rc=0 hard_min_clk=133300 msgs: [0x1c,0x1] uvdgate_calls=1
  clean-valid: PASS (no fault, all values as computed)
----- exit=0 -----