# DF-4397 VERDICT — uninitialize leak

**Status: untested (hardware-gated; source-certain) | confidence: certain**

## Root cause

`vega10_pp_tables_uninitialize()` (vega10_processpptables.c:1183-1228)
was written against an older version of the parser and never grew with
it. Every table produced by `init_powerplay_extended_tables()` is
kzalloc'd (vega10_processpptables.c:308, 387, 535, 569, 610, 676, 733,
776, 838) but only the 9 originals are kfree'd:

leaked per cycle: `vdd_dep_on_socclk`, `vdd_dep_on_dcefclk`,
`vdd_dep_on_pixclk`, `vdd_dep_on_phyclk`, `vdd_dep_on_dispclk`,
`pcie_table`, `valid_socclk_values`, `valid_dcefclk_values`
(allocated at :926-929, :954-957, :936-940, :942-946, :948-952,
:964-967, :986-988, :1000-1002).

Nothing else frees them: vega10_hwmgr.c's backend teardown frees only
`hwmgr->backend` and `dyn_state.vddc_dep_on_dal_pwrl`
(vega10_hwmgr.c:787-790); `phm_hwmgr_backend_fini` doesn't touch
pptable members.

## Trigger cadence

- `/sys/class/drm/cardN/device/pp_table` write (root only, S_IWUSR,
  amdgpu_pm.c:1007) → `pp_dpm_set_pp_table` (amdgpu_powerplay.c:676)
  → `amd_powerplay_reset` → `pptable_fini` + `pptable_init`
  (hwmgr.c:261-281) — leaks once per write.
- GPU unbind/rebind or module reload — leaks once per cycle.

Impact: unbounded kernel heap growth from a privileged trigger; each
reload leaks 8 objects (tens of bytes to a few KB each). Low severity
(DoS-by-memory-exhaustion needs sustained privileged action), CWE-401.

## Verification

Runtime path needs an AMD Vega10 ASIC (absent on the audit guest — no
1002: PCI device, no /dev/dri). Source-certain: the alloc/free set
difference above is mechanical. fix.diff adds the 8 missing
`kfree()+NULL` pairs, `git apply --check` clean, and the patched file
compiles with 0 syntax errors on the guest kernel toolchain
(build.log).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.