# DF-4248 VERDICT

**status: untested** (hardware-gated: no AMD GPU on the audit guest — run.log)
**impact: none demonstrated (OOB read, Low)** | **confidence: certain** (code-trace)

## Trace
processpptables.c:937 uses `>` where `>=` is required, so
`entry_index == ucNumStates` passes the guard; :940-942 then computes the
state entry at `ucNumEntries * ucStateEntrySize` — one entry past the last —
and :953-957 loops `ucStateEntrySize-1` times reading
`pstate_entry->ucClockStateIndices[i]` from that OOB entry, with each index
used to derive a `pclock_info` pointer handed to the hw callback (:959).
Identical defect class to the V2 twin at :913 (DF-1472), but on the
`ucTableFormatRevision < 6` code path — a distinct site requiring its own
hunk, which DF-1472's fix would not touch.

Normally `entry_index < num_of_entries` (callers iterate
`pp_tables_get_num_of_entries`), so the off-by-one requires a table swap
between the two calls (root pp_table write, amd_powerplay.c:672-706) or a
malicious VBIOS that reports different counts across reads. Impact ceiling:
heap OOB *read* of the (attacker-supplied) table image — low.

## Fix
`>` -> `>=` at :937 (and the V2 twin at :913); both contained in
DF-4247/fix.diff. fix_status: not_testable (no hardware to build/run a
kernel with the fix; the one-line change is compile-trivial).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)