{
  "finding_id": "DF-4389",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "process_pptables_v1_0.c:1328 stores the firmware VCE-state count (UCHAR, up to 255; garbage when usVCEStateTableOffset==0) into hwmgr->num_vce_state_tables BEFORE the AMD_MAX_VCE_LEVELS guard, which only skips the fill - so a crafted VBIOS leaves a count of up to 255 over a 6-entry hwmgr->vce_states[] (hwmgr.h:723). Today the sole consumer path is coincidentally fenced (AMDGPU_INFO_VCE_CLOCK_TABLE loops i<6, amdgpu_kms.c:775); any consumer trusting the stored count OOB-reads struct pp_hwmgr into userspace. amdgpu_dpm.c:580 clamps the same count, showing the intended invariant. Low/latent: clamp added in DF-4388 fix.diff; standalone hunit provided. Hardware-gated on guest.",
  "exploit_chain": "",
  "evidence": "README.md trace (path:line); ../DF-4388/unit_test_guest.log case 7 (255->6 PASS); fix.diff git apply --check OK; integrated fixed file compile-validated in DF-4388 (0 errors)",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:1328",
    "sys/dev/drm/amd/powerplay/amd_powerplay.c:868",
    "sys/dev/drm/amd/amdgpu/amdgpu_dpm.c:580"
  ],
  "poc_changes": "n/a - pass-2 finding authored fresh",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 20,
  "guest_dirty": 0,
  "build_cmd": "./build.sh",
  "run_cmd": "./run.sh",
  "code_hash": "398e86569c288338e5c798f61255032f8041923808c0ab7b69a892e3c305d06c",
  "notes": "Status untested = target device absent on guest.",
  "recommended_fix": "clamp num_vce_state_tables to AMD_MAX_VCE_LEVELS before storing (fix.diff; also in DF-4388 fix.diff)",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "not_testable at runtime (no AMD ASIC on guest); standalone fix.diff git-apply OK and the identical hunk is inside DF-4388s compile-validated patched file (guest cc, 0 errors).",
  "fix_evidence": "fix.diff; ../DF-4388/fix_build.log; ../DF-4388/unit_test_guest.log",
  "fix_kernel_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64"
}