# DF-4289 — SS-assignment walk bounded only by unvalidated VBIOS usStructureSize → OOB read (≤64 KB past ATOM table)

Pass-2 finding for `sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c`.
Distinct from DF-1498 (ASIC_ProfilingInfo leakage arrays): this is the
**ASIC_InternalSS_Info** walk in `asic_internal_ss_get_ss_asignment()`
feeding `atomctrl_get_engine_clock_spread_spectrum()` /
`atomctrl_get_memory_clock_spread_spectrum()`.

## The bug (ppatomctrl.c:1231-1243)

```c
ssInfo = &table->asSpreadSpectrum[0];

while (((uint8_t *)ssInfo - (uint8_t *)table) <
        le16_to_cpu(table->sHeader.usStructureSize)) {
        if ((clockSource == ssInfo->ucClockIndication) && ...)
                break;
        ssInfo = (ATOM_ASIC_SS_ASSIGNMENT *)((uint8_t *)ssInfo +
                sizeof(ATOM_ASIC_SS_ASSIGNMENT));
}
```

* `table` comes from `smu_atom_get_data_table(..., &size, ...)`
  (ppatomctrl.c:1204-1207). The atom layer returns a raw pointer into the
  BIOS image (`bios + data_start`) and its `size`/`usStructureSize` are
  VBIOS-controlled; `amdgpu_atom_parse_data_header`
  (sys/dev/drm/amd/amdgpu/atom.c:1384-1403) validates nothing.
* The **only** loop bound is `usStructureSize` — the table's own header
  field — never checked against the actual allocated table size. A VBIOS
  with `usStructureSize` (USHORT) larger than the real table walks
  `ATOM_ASIC_SS_ASSIGNMENT` (10-byte) entries past the end of the BIOS
  image: up to 65535 bytes past the table base, dereferencing
  `ucClockIndication` and `ulTargetClockRange` each step (OOB read,
  CWE-125). On x86-64 kernel heap that is adjacent-kernel-memory read
  until an unmapped page or a coincidental match stops it; the values are
  then copied into `ssEntry` (`speed_spectrum_percentage`,
  `speed_spectrum_rate`) and used to program spread-spectrum PLL
  registers by the callers (ci/iceland/fiji/tonga/vegam smumgr).

## Callers (attach-time, chip-specific)

`atomctrl_get_engine_clock_spread_spectrum` ← ci_smumgr.c:343,
iceland_smumgr.c:843; `atomctrl_get_memory_clock_spread_spectrum` ←
ci_smumgr.c:1084, iceland_smumgr.c:~1090 family — all during SMC table
construction at driver attach.

## Threat model

Crafted VBIOS on an AMD dGPU (same as DF-1498): boot/module-load OOB read
of adjacent kernel heap (bounded 64 KB), potential panic on unmapped page,
or silent programming of garbage SS parameters.

## Reproduce

Not runnable on this guest (no AMD dGPU — env.txt). Trigger shape on
hardware: ASIC_InternalSS_Info table whose header `usStructureSize`
exceeds the table's actual size with no entry matching the requested
clockSource. Expected: OOB read walk / eventual `Fatal trap 12` on
unmapped page during attach.