########## baseline (unfixed) ##########
===== mode 4492 =====
== DF-4492: unchecked pplib indices/strides -> OOB reads ==
BIOS image: 16384 bytes; nonClockInfo[250] lands at bios+16336 (16 bytes PAST the image end, inside the rear redzone)
*** CANARY: nonClockInfo[250] (OOB vs bios allocation) at 0x8004b4050 (len 24) is OUTSIDE every live allocation -> heap OOB access ***
*** CANARY: clockInfo[250] (OOB vs bios allocation) at 0x8004b4050 (len 20) is OUTSIDE every live allocation -> heap OOB access ***
*** CANARY: state[7] of the ucStateEntrySize=254 walk (OOB) at 0x8004b4730 (len 2) is OUTSIDE every live allocation -> heap OOB access ***
rs780_parse_power_table() = 0 num_ps=1
rps[0].class = 0xa5a5 (== canary poison: OOB READ CONFIRMED)
rps[0].caps  = 0xa5a5a5a5 (== canary poison)
rps[0].vclk  = 0xa5a5a5a5 (== canary poison)
ps[0].sclk_low  = 0x00009c40 
canary_violations = 3
exit=98
===== mode 4492g =====
== DF-4492g: far OOB on guard-page-backed BIOS image ==
BIOS image: 16384 bytes at 0x800475000, guard page at 0x800479000
clockInfo[66] (x255) lands at 0x80047927e = 638 bytes PAST the image end (inside the guard page)
calling rs780_parse_power_table() ...

*** SIGNAL 11 at address 0x800479280: SIGSEGV - wild/NULL pointer dereference (kernel: page-fault PANIC) ***
exit=99
===== mode 4493 =====
== DF-4493: no BOOT-classified state -> NULL boot_ps ==
offsetof(struct radeon_ps, ps_priv) = 40 (kernel layout: 40)
rs780_parse_power_table() = 0 num_ps=1 boot_ps=0x0
calling rs780_dpm_enable() with boot_ps == NULL ...
(rs780_dpm.c:78 rs780_get_ps(NULL) reads NULL->ps_priv; kernel: page-fault panic; harness: SIGSEGV at 0x28)

*** SIGNAL 11 at address 0x28: SIGSEGV - wild/NULL pointer dereference (kernel: page-fault PANIC) ***
exit=99
===== mode 4493b =====
== DF-4493b: ucStateEntrySize==1 -> no ps_priv, NULL deref in print ==
rs780_parse_power_table() = 0 num_ps=1 boot_ps=0x0 ps[0].ps_priv=0x0
radeon_dpm_print_power_states() walks 1 states whose ps_priv are NULL ...
(rs780_dpm.c:946 ps->sclk_low with ps == NULL; harness: SIGSEGV at 0x8)
== power state 0 ==
	uvd    vclk: 0 dclk: 0

*** SIGNAL 11 at address 0x8: SIGSEGV - wild/NULL pointer dereference (kernel: page-fault PANIC) ***
exit=99
===== mode 4494 =====
== DF-4494: dangling dpm.ps double free in rs780_dpm_fini ==
[kzalloc #6 (20 bytes) -> INJECTED FAILURE (ENOMEM)]
rs780_parse_power_table() = -12 (ENOMEM injected at state 1)
rdev->pm.dpm.ps is NOT (dangling pointer kept)NULL after the failed parse
rdev->pm.dpm.boot_ps = 0x8004d1d00 (points into the freed array)
driver unload -> radeon_pm_fini -> rs780_dpm_fini ...
*** CANARY ALLOCATOR: DOUBLE FREE of 0x8004d1d00 (size 96) DETECTED ***
rs780_dpm_fini() returned; canary_violations so far = 1 (DOUBLE FREE detected above)
canary_violations = 1
exit=98
===== mode 4494u =====
== DF-4494u: enable after ENOMEM-dangling -> UAF read ==
[kzalloc #6 (20 bytes) -> INJECTED FAILURE (ENOMEM)]
rs780_parse_power_table() = -12, dpm.ps=0x8004d1d00 boot_ps=0x8004d1d00
*** CANARY: boot_ps (&dpm.ps[0]) == 0x8004d1d00 points into a FREED allocation (size 96) -> USE AFTER FREE ***
calling rs780_dpm_enable() (reads ps[0].ps_priv from the FREED array, then dereferences the 0xB0B0.. value) ...

*** SIGNAL 10 at address 0x0: abort ***
exit=99
===== mode 4494w =====
== DF-4494w: rs780_dpm_init self-fini (:933) + swallowed error -> UAF write ==
rs780_dpm_init() = -22 (igp header missing; init called radeon_dpm_fini itself at :933)
after init: dpm.ps=0x8004d1700 priv=0x8004c1500 boot_ps=0x8004d1700 (all dangling)
radeon_pm.c:1448 swallows the error -> rs780_get_pm_mode_parameters writes the FREED igp_power_info ...
*** CANARY: freed object igp_power_info (dpm.priv) (0x8004c1500, 32 bytes) has 8 bytes != 0xb0 -> object WRITTEN AFTER FREE (UAF WRITE) ***
continuing into rs780_dpm_enable() (boot_ps/ps also freed) ...

*** SIGNAL 10 at address 0x0: abort ***
exit=99

########## fixed (-DFIX_ALL) ##########
===== mode 4492 (fixed) =====
== DF-4492: unchecked pplib indices/strides -> OOB reads ==
BIOS image: 16384 bytes; nonClockInfo[250] lands at bios+16336 (16 bytes PAST the image end, inside the rear redzone)
DRM_ERROR: nonClockInfoIndex 250 walks past the table
rs780_parse_power_table() = -22 num_ps=0
crafted table rejected (fix active)
canary_violations = 0
exit=0
===== mode 4492g (fixed) =====
== DF-4492g: far OOB on guard-page-backed BIOS image ==
BIOS image: 16384 bytes at 0x800475000, guard page at 0x800479000
clockInfo[66] (x255) lands at 0x80047927e = 638 bytes PAST the image end (inside the guard page)
calling rs780_parse_power_table() ...
DRM_ERROR: clockInfoIndex 66 walks past the table
rs780_parse_power_table() = -22 - returned (fix active)
canary_violations = 0
exit=0
===== mode 4493 (fixed) =====
== DF-4493: no BOOT-classified state -> NULL boot_ps ==
offsetof(struct radeon_ps, ps_priv) = 40 (kernel layout: 40)
rs780_parse_power_table() = 0 num_ps=1 boot_ps=0x0
calling rs780_dpm_enable() with boot_ps == NULL ...
(rs780_dpm.c:78 rs780_get_ps(NULL) reads NULL->ps_priv; kernel: page-fault panic; harness: SIGSEGV at 0x28)
DRM_ERROR: no boot power state, refusing to enable DPM
rs780_dpm_enable() returned -22 - NO CRASH (fix active)
canary_violations = 0
exit=0
===== mode 4493b (fixed) =====
== DF-4493b: ucStateEntrySize==1 -> no ps_priv, NULL deref in print ==
DRM_ERROR: invalid ucStateEntrySize 1
rs780_parse_power_table() = -22 num_ps=0 boot_ps=0x0 ps[0].ps_priv=0x0
crafted table rejected (fix active: ucStateEntrySize < 2 is malformed)
canary_violations = 0
exit=0
===== mode 4494 (fixed) =====
== DF-4494: dangling dpm.ps double free in rs780_dpm_fini ==
[kzalloc #6 (20 bytes) -> INJECTED FAILURE (ENOMEM)]
rs780_parse_power_table() = -12 (ENOMEM injected at state 1)
rdev->pm.dpm.ps is NULL after the failed parse
rdev->pm.dpm.boot_ps = 0x0 (NULL)
driver unload -> radeon_pm_fini -> rs780_dpm_fini ...
rs780_dpm_fini() returned; canary_violations so far = 0 (fix active: pointer NULLed after cleanup, no double free)
canary_violations = 0
exit=0
===== mode 4494u (fixed) =====
== DF-4494u: enable after ENOMEM-dangling -> UAF read ==
[kzalloc #6 (20 bytes) -> INJECTED FAILURE (ENOMEM)]
rs780_parse_power_table() = -12, dpm.ps=0x0 boot_ps=0x0
calling rs780_dpm_enable() (reads ps[0].ps_priv from the FREED array, then dereferences the 0xB0B0.. value) ...
DRM_ERROR: no boot power state, refusing to enable DPM
rs780_dpm_enable() returned -22 - NO CRASH (fix active: dpm.ps/boot_ps NULLed, enable guard)
canary_violations = 0
exit=0
===== mode 4494w (fixed) =====
== DF-4494w: rs780_dpm_init self-fini (:933) + swallowed error -> UAF write ==
DRM_ERROR: No integrated system info for your GPU
rs780_dpm_init() = -22 (igp header missing; init called radeon_dpm_fini itself at :933)
after init: dpm.ps=0x8004d1700 priv=0x8004c1500 boot_ps=0x8004d1700 (all dangling)
radeon_pm.c:1448 swallows the error -> rs780_get_pm_mode_parameters writes the FREED igp_power_info ...
continuing into rs780_dpm_enable() (boot_ps/ps also freed) ...
rs780_dpm_enable() returned 0
UAF WRITE detection result reported above (fix active: init no longer tears the state down)
canary_violations = 0
exit=0
RUN_DONE