# DF-4666 — VERDICT

**Status: reproduced** (harness: verbatim function, 1:1 struct layout; run on
the DragonFly 6.5-DEVELOPMENT guest).

## Observations (run.log)

1. **[safe]** With `count = 0` (the crafted-VBIOS state produced by a GPIO
   VDDCI LUT with `ucGpioEntryNum == 0`), the verbatim fallback computes
   `&entries[(uint32_t)0 - 1]` → byte offset **0x7FFFFFFF8 (34,359,738,360 ≈
   32 GiB)** past `entries` — far outside any possible mapping of the
   `struct smu7_hwmgr` heap object.
2. **[deref]** Actually invoking the verbatim function with count==0 dies
   **SIGSEGV (exit 139)** — the read address is unmapped. In the kernel this
   is a page fault in `phm_find_closest_vddci` during SMC-table population at
   driver load → panic.
3. **[normal]** Control run (count=4) shows the populated path behaves
   correctly — the harness compiles the function faithfully.
4. **[patched]** Twin with the `count == 0` guard returns the caller's vddci
   with no wild access; the count=4 path is unchanged — **fix validated**.

## Why it is reachable

`atomctrl_get_voltage_table_v3` (ppatomctrl.c:546-563) accepts
`ucGpioEntryNum == 0` (assert is only `<= 32`) and returns success with
`count = 0`; `smu7_construct_voltage_tables` (smu7_hwmgr.c:276-282) accepts
it for `vddci_control == BY_GPIO`; nothing downstream rejects an empty table
(the trim at smu7_hwmgr.c:337-342 only handles too-large). The polaris10 /
vegam / fiji SMC populators then call `phm_find_closest_vddci` whenever a dep
entry has `vddci == 0` (legal VBIOS field value). Threat model: crafted VBIOS
/ VFIO / root sysfs pp_table — same as the rest of the powerplay family.

## Ceiling

Wild *read* at a fixed huge offset → deterministic panic (DoS); no
disclosure or write primitive. Severity Medium, consistent with sibling
DF-1798 (Medium, OOB read via unvalidated vddInd).

## Kernel references

* sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:426-437 (unguarded `entries[i-1]`)
* sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:393,413 (siblings that DO guard)
* sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:546-563 (ucGpioEntryNum==0 accepted)
* sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:276-282,337-342 (count==0 survives construction)
* sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:377,402 (call sites)

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.