{
  "finding_id": "DF-4289",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "asic_internal_ss_get_ss_asignment() (ppatomctrl.c:1215-1273) bounds its ATOM_ASIC_SS_ASSIGNMENT walk solely by the table headers usStructureSize (ppatomctrl.c:1233-1234) \u2014 a VBIOS-controlled USHORT that is never validated against the actual data-table/ROM extent (amdgpu_atom_parse_data_header, sys/dev/drm/amd/amdgpu/atom.c:1384-1403, performs no validation and struct atom_context does not even track the BIOS image length). A crafted ASIC_InternalSS_Info table with an oversized usStructureSize and no matching ucClockIndication walks the fixed 10-byte stride past the end of the BIOS image, reading ucClockIndication/ulTargetClockRange from adjacent kernel heap for up to 65535 bytes (CWE-125); results are programmed into CG_SPLL/MPLL spread-spectrum registers by the ci/iceland/fiji/tonga/vegam smumgr callers at attach. Note: the size returned by smu_atom_get_data_table IS usStructureSize (same header field), so the existing fetch-and-ignore of `size` cannot bound the walk \u2014 the fix must live in the atom layer (validate idx+size <= ROM length), which is what fix.diff implements. Same crafted-VBIOS threat model and Medium band as DF-1498. NOT runnable on this guest (no AMD dGPU; no drm module loads \u2014 env.txt); trace-certain.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (trace incl. the size==usStructureSize identity); README.md; fix.diff (atom.c ROM-bounds validation + bios_size plumbing); env.txt",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:1231",
    "sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:1235",
    "sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:1241",
    "sys/dev/drm/amd/amdgpu/atom.c:1384"
  ],
  "poc_changes": "n/a \u2014 no AMD dGPU on guest; code-trace evidence pack",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "notes": "Hardware-absent case (DF-1497/DF-1498 precedent). Callers: atomctrl_get_engine_clock_spread_spectrum (ppatomctrl.c:1289) <- ci_smumgr.c:343, iceland_smumgr.c:843; atomctrl_get_memory_clock_spread_spectrum (ppatomctrl.c:1278) <- ci_smumgr.c:1084.",
  "recommended_fix": "Track BIOS image length in atom_context and reject data tables whose idx+size exceed it in amdgpu_atom_parse_data_header",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Baseline behavior not reproducible on this guest (no AMD dGPU) -> no fixed-kernel build possible. fix.diff authored from trace.",
  "fix_evidence": "findings/poc/DF-4289/fix.diff (not applied to sys/; authored post-verification from line-accurate trace)"
}