{
  "finding_id": "DF-4666",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "Harness-verified on the DragonFly 6.5-DEVELOPMENT guest with the verbatim kernel function and 1:1 struct layout: phm_find_closest_vddci (smu_helper.c:426-437) is the only member of its lookup family with no empty-table guard; with count==0 the fallback return vddci_table->entries[i-1].value indexes entries[0xFFFFFFFF], reading at +0x7FFFFFFF8 (34,359,738,360 bytes ~ 32 GiB) past the heap object. The deref run of the verbatim function dies SIGSEGV(139); in-kernel this is a guaranteed page fault / panic during SMC table population at driver load. count==0 is reachable from a crafted VBIOS: atomctrl_get_voltage_table_v3 (ppatomctrl.c:546-563) accepts ucGpioEntryNum==0 (assert is only <=32) and returns success, smu7_construct_voltage_tables accepts it for BY_GPIO vddci_control, and polaris10/vegam/fiji populators invoke the lookup whenever a dep-table entry has vddci==0. Patched twin (count==0 guard) returns the callers vddci with no wild access; normal path unchanged.",
  "exploit_chain": "crafted VBIOS / VFIO / root sysfs pp_table with a VDDCI GPIO LUT of zero entries (and any dep entry with vddci==0) -> vddci_voltage_table.count=0 survives construction -> phm_find_closest_vddci -> kernel read at backend+0x7FFFFFFF8 -> page fault -> panic (DoS). Read-only primitive; no disclosure or write.",
  "evidence": "findings/poc/DF-4666/run.log: [safe] effective byte offset = 34359738360 (0x7fffffff8) + WILD-READ CONFIRMED; [deref] ... Segmentation fault ... exit status: 139; [normal] returns entries[3].value = 830; [patched] FIX VALIDATED.",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:426-437",
    "sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:546-563",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:276-282",
    "sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c:377"
  ],
  "poc_changes": "Seed harness authored fresh (no prior seed): verbatim smu_helper.c:426-437 body plus 1:1 pp_atomctrl_voltage_table layout from ppatomctrl.h; three modes (safe address math, live deref, populated control) plus patched twin.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 240,
  "guest_dirty": 0,
  "build_cmd": "cc -O0 -g -Wall -o find_closest_vddci_zero find_closest_vddci_zero.c && cc -O0 -g -Wall -o find_closest_vddci_zero_patched find_closest_vddci_zero_patched.c",
  "run_cmd": "sh run.sh",
  "code_hash": "9b1c2699894cbc5e87b0194866557b0e703c9fed87febe559b437a0f6b39dec5",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Patched twin with the count==0 / >32 guard returns the callers vddci for the empty table and still returns entries[3].value for the populated control \u2014 wild access eliminated, behavior preserved. Full kernel rebuild not performed (no AMD GPU on the audit guest; verbatim-function harness is the faithful validation surface).",
  "fix_evidence": "findings/poc/DF-4666/run.log [patched] section: FIX VALIDATED: empty table no longer indexes entries[0xFFFFFFFF].",
  "notes": "Distinct from DF-1797 (OOB write via oversized counts in the svi2/trim family) and DF-1798 (vddInd OOB read): this is an underflowed index on an EMPTY table in a function whose siblings guard exactly this case.",
  "recommended_fix": "Add the same empty-table guard as phm_get_voltage_index/phm_get_voltage_id to phm_find_closest_vddci (return caller vddci on NULL/count==0/count>32)."
}