# DF-4774 — smu7 SMC-firmware upload: unvalidated header offset/size → kernel heap OOB read

**File:** `sys/dev/drm/amd/powerplay/smumgr/smu7_smumgr.c` (pass 2)
**Function:** `smu7_upload_smu_firmware_image()` :481-500 → `smu7_upload_smc_firmware_data()` :461-478
**Twins (filed):** DF-2065 (radeon si_smc.c), DF-2096 (amdgpu ci_smc.c), DF-2104 (radeon ci_smc.c) — this is the unfiled **powerplay smu7** leg (Tonga/Fiji/Polaris/Topaz/VegaM).

## Build

```sh
sh build.sh        # cc -O0 -g -Wall: smu7_fw_upload_oob + smu7_fw_upload_oob_patched
```

## Run

```sh
sh run.sh          # baseline then patched twin
```

## Expected output (baseline)

* `[1]` legit header (off=0x400 size=0x800): 512 dwords streamed, 0 canary hits — sanity that the verbatim path works.
* `[2]` `off = 0x1000` (end of the 0x1000-byte blob, into the canary page), `size = 0x1000`:
  `canary bytes in SMC sink : 1024`, `sink sample: cc000000 cc000001 ...`,
  **`ADJACENT-OOB-READ CONFIRMED`** — kernel memory past the firmware allocation is streamed dword-by-dword into SMC SRAM via MMIO.
* `[3]` `off = 0x40000000`, `size = 0x20000` (max the length gate allows): **child killed by SIGSEGV** — kernel-panic equivalent wild read.
* `[4]` `off = 0xFFFFF000` (~4 GB): **child killed by SIGSEGV**.
* `[5]` the *only* check on the path (`limit >= byte_count`, smu7_smumgr.c:465) rejects `size > 0x20000` — nothing bounds the base offset.

## Expected output (patched twin — fix.diff bound check in amdgpu_cgs.c:461-472)

* `[2]`/`[3]`/`[4]`: **`FIX VALIDATED`** — the construction is rejected (`-EINVAL`) before any read; 0 dwords streamed; no fault.
* `[1]` legit header still uploads (512 dwords) — no functional regression.

## Threat

The SMC firmware file is loaded at powerplay `start_smu` (`request_firmware` at
amdgpu_cgs.c:437, validated only by `amdgpu_ucode_validate` = `datasize == size_bytes`,
amdgpu_ucode.c:251-259). `ucode_array_offset_bytes`/`ucode_size_bytes` are
self-declared by that file and reach the upload loop unchecked — a crafted
firmware file (root-placed in the firmware path) makes the kernel read up to
128 KB from up to ~4 GB past the firmware blob. Impact: panic-class DoS plus
adjacent-kernel-memory disclosure into GPU SMC SRAM. Requires an AMD VI GPU
(smu7 family) and control of the firmware file — same trust model as the filed
twin family.

## Verdict

`status=reproduced`, `impact=dos` (wild read → panic; adjacent-read exfil into
device SRAM demonstrated; no userland readback primitive without further bugs).
Deterministic: 3/3 runs identical (`run.log`, `run.2.log`, `run.3.log`).
No AMD GPU on the audit guest → verbatim-function harness methodology
(identical to DF-4665/DF-3683/DF-2096). See `VERDICT.md`.