# DF-4397 — vega10_pp_tables_uninitialize leaks 8 subtable allocations per reload

**Severity: Low (root-triggered unbounded kernel-heap growth) | Confidence: certain**

## What

`sys/dev/drm/amd/powerplay/hwmgr/vega10_processpptables.c:1183-1228`:
`vega10_pp_tables_uninitialize()` frees only 9 of the ~17 allocations
made by `vega10_pp_tables_initialize()`/`init_powerplay_extended_tables()`/
`init_dpm_2_parameters()`. Leaked on every teardown/re-init cycle:

| allocation site | freed? |
|---|---|
| vdd_dep_on_sclk (931-934) | yes |
| vdd_dep_on_mclk (959-962) | yes |
| **vdd_dep_on_socclk (926-929)** | **NO** |
| **vdd_dep_on_dcefclk (954-957)** | **NO** |
| **vdd_dep_on_pixclk (936-940)** | **NO** |
| **vdd_dep_on_phyclk (942-946)** | **NO** |
| **vdd_dep_on_dispclk (948-952)** | **NO** |
| **pcie_table (964-967)** | **NO** |
| **valid_socclk_values (986-988)** | **NO** |
| **valid_dcefclk_values (1000-1002)** | **NO** |
| valid_sclk_values (993-995) / valid_mclk_values (1007-1009) | yes |
| lookup tables ×3 (1108-1127) | yes |
| mm_dep_table / tdp_table | yes |

Lifecycle: `pp_dpm_set_pp_table` (amdgpu_pm.c:676-700, sysfs `pp_table`,
S_IWUSR) → `amd_powerplay_reset` → `pptable_fini` (hwmgr.c:261-281) +
`pptable_init` — each reload leaks ~8 small allocations (typically a
few hundred bytes to a few KB each, counts are u8-bounded). Rebind/
module reload cycles leak the same. Kernel-heap memory exhaustion over
repeated root-triggered reloads (CWE-401). Upstream later rewrote this
teardown to free everything.

## Reproduce / validation

Static source diff (alloc list vs free list) is the proof — see
VERDICT.md. Hardware-gated for runtime (no AMD GPU on the audit guest);
`fix.diff` adds the 8 missing kfree pairs, `git apply --check` clean,
and the patched file syntax-validates with **0 errors** on the guest
kernel toolchain (build.log).