# VERDICT — DF-4545

## Reproduced: YES (lifted-copy harness on the audit guest; in-kernel path hardware-gated)

- **Root cause proven** (vega20_processpptables.c):
  - :823 — the `ucODTableRevision == 1` gate around ALL three OD copies;
    revision != 1 skips them silently.
  - :835-846 / :870-877 — the five copy-helper return codes are dropped
    (CWE-252); a -ENOMEM leaves the pointers NULL.
  - :889-891 — init returns `result` of append_vbios_pptable (0), so
    vega20_pp_tables_initialize reports SUCCESS with NULL od arrays.
- **Consumer proven** (vega20_hwmgr.c): backend_init (hwmgr.c:229, after
  pptable_init at :222) → vega20_enable_dpm_tasks →
  vega20_od8_initialize_default_settings (:1598) →
  vega20_od8_set_feature_capabilities — first deref `od_feature_capabilities[
  ATOM_VEGA20_ODFEATURE_GFXCLK_LIMITS]` at :906, guarded only by
  `smu_features[GNLD_DPM_GFXCLK].enabled` (true on functioning silicon).
  No NULL check anywhere on the path (checked :906-:976 and :1216-1221).
- **Harness result** (run.log): VARIANT A (crafted ucODTableRevision=2,
  all header checks pass, Version=3) → init SUCCESS with
  `od_feature_capabilities=0x0` → consumer **SIGSEGV at 0x0** — the
  kernel-equivalent panic. VARIANT B (rev=1, injected kzalloc failure) →
  identical fault, proving the ignored -ENOMEM is equally fatal.
  CONTROL (rev=1 healthy) runs clean; PATCHED (fix.diff) refuses init
  (-EINVAL) and the consumer never runs.

## Impact

Deterministic kernel panic (NULL-deref) at amdgpu driver load on a machine
whose VBIOS carries an OverDrive8 revision other than 1 — a value the
driver parses but never accepts, reporting success instead of rejecting the
table. Same crafted-firmware precondition as DF-1689/DF-1690 (Medium per
family convention); also a memory-pressure-induced variant. DoS only —
NULL write at a fixed offset 0, no controllable data.

## Fix validation

- `git apply --check` OK
- Full amdgpu.ko rebuild with the fix under the real kernel toolchain with
  -Werror: RC=0 (fix_build.log); /usr/src restored + verified
- Harness PATCHED control: crafted table rejected at init, no fault

## Kernel refs
sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:823,
sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:835,
sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:839,
sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:843,
sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:870,
sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:874,
sys/dev/drm/amd/powerplay/hwmgr/vega20_processpptables.c:889,
sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:906,
sys/dev/drm/amd/powerplay/hwmgr/vega20_hwmgr.c:1598,
sys/dev/drm/amd/powerplay/hwmgr/hwmgr.c:222,
sys/dev/drm/amd/powerplay/hwmgr/hwmgr.c:229

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.