# DF-4289 VERDICT — SS-assignment OOB walk

## Status: inconclusive (code-trace certain; guest has no AMD dGPU)

## Trace

* `asic_internal_ss_get_ss_asignment()` — ppatomctrl.c:1215-1273.
  - :1226-1229 table = `asic_internal_ss_get_ss_table(hwmgr->adev)`; NULL-checked.
  - :1204-1207 the table is `smu_atom_get_data_table(..., &size, &frev, &crev)`
    — **`size` is fetched but never used** anywhere in the function.
  - :1231-1243 walk bound is exclusively
    `le16_to_cpu(table->sHeader.usStructureSize)` — a field inside the
    (attacker-supplied) table content, not the atom-layer table size.
  - Each iteration reads `ssInfo->ucClockIndication` (:1235) and
    `ssInfo->ulTargetClockRange` (:1236) — reads happen at the *current*
    offset before the bound is re-checked, so a `usStructureSize` larger
    than the real table immediately reads past it; stride
    `sizeof(ATOM_ASIC_SS_ASSIGNMENT)` (fixed), max excursion ≤ 0xFFFF bytes.
* Atom layer (`sys/dev/drm/amd/amdgpu/atom.c:1384-1403`):
  `amdgpu_atom_parse_data_header()` performs no validation of `idx`,
  `*size`, or the bios buffer bounds; `smu_atom_get_data_table`
  (smu_helper.c:660-673) passes the raw pointer through.
* Exit conditions: match on (clockSource, clockSpeed ≤ ulTargetClockRange)
  or bound reached. Non-matching crafted table ⇒ full 64 KB excursion.
* Output `ssEntry` fields (:1246-1254): `speed_spectrum_percentage`,
  `speed_spectrum_rate` (raw VBIOS USHORT, and for table rev ≥ 2.2/3
  divided by the constant 100 at :1253 — see DF-4290 for the div0 that
  this value feeds), `speed_spectrum_mode`. These are consumed by
  ci_smumgr.c:343-356 / :1084-1092 and equivalents in
  iceland/fiji/tonga/vegam smumgr to program CG_SPLL_SPREAD_SPECTRUM /
  MPLL_SS registers.

## Bound check on the *other* dimension (verified safe)

The fixed-stride walk starts at `offsetof(ATOM_ASIC_INTERNAL_SS_INFO,
asSpreadSpectrum[0])` and the bound is checked before each iteration's
reads, so for a *correct* usStructureSize there is no OOB; the defect is
solely the unvalidated upper bound. No write occurs (pure read walk +
copy-out into the caller's `pp_atomctrl_internal_ss_info`).

## Impact

Boot/module-load OOB read of adjacent kernel heap (CWE-125), panic on
unmapped page possible, or programming of garbage PLL/SS register values
(hardware-stability impact). Crafted-VBIOS threat model ⇒ Medium,
consistent with DF-1498. Not runnable on this guest (no AMD dGPU) ⇒
inconclusive status, trace-certain.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.