{
  "finding_id": "DF-4388",
  "status": "reproduced",
  "impact_class": "memcorrupt (heap OOB write + OOB reads + leak) / dos ceiling, VBIOS-crafted",
  "reproduce": {
    "build": "./build.sh /usr/src   (on the DF audit guest: verbatim check vs /usr/src + cc 8.3 builds rig_base and rig_fixed)",
    "run": "./run.sh               (baseline vs fixed A/B over 18 crafted-table modes)",
    "expected": "BASELINE: 13 classified SIGSEGVs (heap OOB WRITE at kzalloc(164)+0, image+65280/65281 offset reads, image+131 count loop, image+2914 VCE index, image-2 entries[-1] underflow, image+178 off-by-one, NULL+0 twice) + leak-canary '175/175 leaked field values byte-exact' + gpio 'PARSED' from header + vce count STORED=200; FIXED: 0 SIGSEGVs, counts clamped (16/3/5/6), graceful rc=-1/-22 rejections, clean-valid PASS identical in both builds"
  },
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:176",
    "sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:522",
    "sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:745",
    "sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:1042",
    "sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:1219",
    "sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:1263",
    "sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:1310",
    "sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:1328",
    "sys/dev/drm/amd/powerplay/hwmgr/hwmgr.c:86",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:5144"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "fix.diff",
    "build.sh", "run.sh", "build.log", "run.log", "run.2.log", "run.3.log",
    "env.txt", "hw_probe.log", "manifest.json", "verdict.json",
    "rig/gen_rig.sh", "rig/check_verbatim.sh", "rig/rig_shims.h",
    "rig/pp_rig.c", "rig/Makefile", "rig/build.sh", "rig/run.sh",
    "rig/pp_slice.inc", "rig/pp_slice_fixed.inc", "rig/pp_slice_verbatim.h",
    "rig/code_hashes.txt",
    "process_pptables_v1_0_fixed.c", "v1_clamp_test.c",
    "syntax_check_guest.txt", "unit_test_guest.log",
    "fix_build.log", "fix_run.log"
  ]
}