########## baseline (unfixed) ##########
===== mode 4187 =====
== DF-4187: sumo_dpm_enable NULL boot_ps ==
offsetof(struct radeon_ps, ps_priv) = 40 (kernel layout: 40)
sumo_parse_power_table() = 0 num_ps=1 boot_ps=0x0
calling sumo_dpm_enable() with boot_ps == NULL ...

*** SIGNAL 11 at address 0x28: SIGSEGV - wild/NULL pointer dereference (kernel: page-fault PANIC) ***
exit=99
===== mode 4188 =====
== DF-4188: dangling dpm.ps double free in sumo_dpm_fini ==
[sumo_ps#1] kzalloc(#6, 128) -> INJECTED FAILURE (ENOMEM)
sumo_parse_power_table() = -12 (ENOMEM injected at state 1)
rdev->pm.dpm.ps is NOT (dangling pointer kept)NULL after the failed parse
driver unload -> radeon_pm_fini -> sumo_dpm_fini ...
*** CANARY ALLOCATOR: DOUBLE FREE of 0x8004d1d00 (size 96) DETECTED ***
sumo_dpm_fini() returned; canary_violations so far = 1 (DOUBLE FREE detected above)
canary_violations = 1
exit=98
===== mode 4189 =====
== DF-4189: ucNumDPMLevels==0 -> num_levels==0 -> levels[0xFFFFFFFF] wild read ==
variant note: num_levels is u32; num_levels-1 == 0xFFFFFFFF, so the index is levels[0xFFFFFFFF] = object + 0xFFFFFFFF*24 (~96 GB past the kzalloc'd sumo_ps)
sumo_parse_power_table() = 0 num_ps=2
state0 ps_priv=0x8004e2140 levels=0x8004e2140 num_levels=0 (kzalloc'd, all zero)
expected fault address for levels[num_levels-1].sclk ~= 0x20004e2128 (object + ~95 GB)
calling sumo_set_uvd_clock_before_set_eng_clock (sumo_dpm.c:847 levels[num_levels-1]) ...

*** SIGNAL 11 at address 0x20004a5258: SIGSEGV - wild/NULL pointer dereference (kernel: page-fault PANIC) ***
exit=99
===== mode 4190 =====
== DF-4190: unchecked nonClockInfoIndex -> OOB read ==
*** CANARY: nonClockInfo[250] (bios-relative OOB read) at 0x8004b55b2 (len 24) is OUTSIDE every live allocation -> heap OOB access ***
bios image: 16384 bytes at 0x8004b0040; nonClockInfo[250] lands at bios+21874 (5490 bytes PAST the end of the image)

*** SIGNAL 11 at address 0x8004b55b2: SIGSEGV - wild/NULL pointer dereference (kernel: page-fault PANIC) ***
exit=99

########## fixed (-DFIX_ALL) ##########
===== mode 4187 (fixed) =====
== DF-4187: sumo_dpm_enable NULL boot_ps ==
offsetof(struct radeon_ps, ps_priv) = 40 (kernel layout: 40)
sumo_parse_power_table() = 0 num_ps=1 boot_ps=0x0
calling sumo_dpm_enable() with boot_ps == NULL ...
DRM_ERROR: no boot power state, refusing to enable DPM
sumo_dpm_enable() returned -1 - NO CRASH (fix active)
canary_violations = 0
exit=0
===== mode 4188 (fixed) =====
== DF-4188: dangling dpm.ps double free in sumo_dpm_fini ==
[sumo_ps#1] kzalloc(#6, 128) -> INJECTED FAILURE (ENOMEM)
sumo_parse_power_table() = -12 (ENOMEM injected at state 1)
rdev->pm.dpm.ps is NULL after the failed parse
driver unload -> radeon_pm_fini -> sumo_dpm_fini ...
sumo_dpm_fini() returned; canary_violations so far = 0 (fix active: pointer NULLed after cleanup, no double free)
canary_violations = 0
exit=0
===== mode 4189 (fixed) =====
== DF-4189: ucNumDPMLevels==0 -> num_levels==0 -> levels[0xFFFFFFFF] wild read ==
variant note: num_levels is u32; num_levels-1 == 0xFFFFFFFF, so the index is levels[0xFFFFFFFF] = object + 0xFFFFFFFF*24 (~96 GB past the kzalloc'd sumo_ps)
DRM_ERROR: power state 0 has no DPM levels
sumo_parse_power_table() = -22 num_ps=0
sumo_parse_power_table() rejected the crafted table (fix active: zero-level state rejected)
canary_violations = 0
exit=0
===== mode 4190 (fixed) =====
== DF-4190: unchecked nonClockInfoIndex -> OOB read ==
DRM_ERROR: invalid nonClockInfoIndex 250
sumo_parse_power_table() = -22
crafted table rejected (fix active)
canary_violations = 0
exit=0
RUN_DONE
RUN_RC=0