{
 "finding_id": "DF-4703",
 "poc_id": "DF-4703",
 "status": "untested",
 "reproduced": 0,
 "impact": "Kernel reads past the declared table (potentially past the mapped ROM image): garbage power tables / fault-on-read near the ROM end",
 "confidence": "likely",
 "attempts": 0,
 "guest_uname": null,
 "code_hash": null,
 "exploit_chain": [],
 "evidence": "Every data-table accessor discards the size out-param and casts the ROM pointer to a full fixed struct after checking only frev/crev - a table declaring a small structuresize (or pointing near the ROM end) yields OOB reads; the ~150-byte smc_dpm_info walk is the biggest. Same trust model as DF-1815..1817 but a distinct mechanism (fixed-offset casts at 6 sites pass 1 did not file). Fetch-and-validate-the-size fix.",
 "kernel_refs": [
  "sys/dev/drm/amd/powerplay/hwmgr/ppatomfwctrl.c:61",
  "sys/dev/drm/amd/powerplay/hwmgr/ppatomfwctrl.c:169",
  "sys/dev/drm/amd/powerplay/hwmgr/ppatomfwctrl.c:287",
  "sys/dev/drm/amd/powerplay/hwmgr/ppatomfwctrl.c:471",
  "sys/dev/drm/amd/powerplay/hwmgr/ppatomfwctrl.c:592",
  "sys/dev/drm/amd/powerplay/hwmgr/ppatomfwctrl.c:624"
 ],
 "verdict": "not_run: no AMD GPU on guest; mechanism by inspection of smu_helper.c/atom.c (no bounds validation of data_start/size)",
 "fix_status": "not_testable",
 "fix_baseline_reproduced": 0,
 "fix_patched_reproduced": 0,
 "fix_verdict": "not_testable: hardware/boot-flag gated",
 "fix_evidence": "fix in finding markdown"
}