# DF-4249 VERDICT

**status: untested** (hardware-gated: no AMD GPU — run.log)
**impact: none demonstrated (bounded within-image OOB read, Low)**
**confidence: certain** (code-trace)

## Trace
* processpptables.c:1485-1490: `extended_header` is computed from an
  unvalidated offset, then `extended_header->usPPMTableOffset` (offset 16)
  is read in the *condition* while the `usSize >= V5` (>= 18 bytes) guard is
  evaluated only afterwards in the same `&&` chain — C evaluates
  `usPPMTableOffset > 0` first. For an extended header whose `usSize` is
  12..15 (V2/V3-sized), bytes 16-17 lie beyond the declared sub-table.
* processpptables.c:1029-1033: `init_overdrive_limits_V2_1` has no `usSize`
  gate whatsoever before reading `ulMaxEngineClock` (offset 4..7) and
  `ulMaxMemoryClock` (8..11). The sibling getters (get_vce_table_offset:63,
  get_uvd_table_offset:164, get_samu:229, get_acp:265, get_cacp_tdp:301,
  get_sclk_vdd_gfx:352) all gate on `usSize` first — this one is the
  outlier.

Both reads stay inside the surrounding VBIOS image in practice (the
extended header sits mid-image), so the practical impact is mis-parsed
limits/offset, not a slab overread — rated Low. The PPM offset misuse
compounds with DF-1470 until the central layer lands.

## Fix
In DF-4247/fix.diff (condition reorder + range checks). fix_status:
not_testable (hardware-gated).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)