# DF-4858 VERDICT

**Finding:** wrong-variable store at `sys/dev/drm/radeon/rv730_dpm.c:181` —
`mpll_ss |= CLK_V(clk_v);` where the cleared-at-:180 target was `mpll_ss2`.
Corrupts the memory-clock spread-spectrum register pair programmed into the
SMC state table.

**Status: REPRODUCED** (logic level, verbatim-replica harness on the audit
guest; kernel-level trigger hardware-gated — guest has no Radeon GPU;
methodology per DF-4492 precedent for this driver family).

**Impact:** none at the kernel-memory level (fixed-size register-word
arithmetic, no OOB, no pointer involvement) — the impact is **hardware
misprogramming**: SSEN-enabled mclk SS with zero depth (CLK_V never lands in
mpll_ss2) plus CLK_S field (bits 4-15) clobbered by clk_v's low bits, on real
SS-enabled RV730 boards on every DPM mclk population. Ceiling: mclk
instability / GPU wedge (functional DoS of the graphics stack). No
escalation chain exists for this class.

## How it was proven

1. **Typo proof (source):**
   - rv730_dpm.c:180 clears `CLK_V_MASK` **in mpll_ss2**, then :181 ORs
     `CLK_V(clk_v)` **into mpll_ss**.
   - Same-file sclk twin (rv730_dpm.c:104-105) does it correctly:
     `cg_spll_spread_spectrum_2 &= ~CLK_V_MASK; cg_spll_spread_spectrum_2 |= CLK_V(clk_v);`
   - Same-tree rv740_dpm.c:262-266 pairs each mask with its own word.
   - Upstream Linux master rv730_dpm.c carries the identical mclk typo
     (checked against torvalds/linux); DFly inherited it in the drm port.
2. **Executable proof (guest):** `mclkss.c` replicates :119-196 verbatim
   (dividers/SS entry as inputs; the `pi->mclk_ss` gate and
   `radeon_atombios_get_asic_ss_info` match are preconditions by
   construction). Baseline (`run.log`):
   - mode `real` (rate=3000, percentage=20000, fb_div=932, ref 2700):
     clk_s=2 clk_v=932 → mpll_ss CLK_S field becomes **58** (2 | (932>>4)&0xfff),
     mpll_ss2 CLK_V field **0** — SMC would run SS at depth 0 with corrupted
     step; VIOLATIONS V1+V2, exit=98.
   - mode `crafted` (percentage=65535, fb_div=2047): CLK_S 1→**839**, exit=98.
   - Fixed build (`-DFIX_DF4858`): fields exact (CLK_S=2/1, CLK_V=932/13415
     in mpll_ss2), exit=0.

## Fix validation

- `fix.diff` (one line, `mpll_ss2 |= CLK_V(clk_v);`) applied to the guest
  `/usr/src` (with DF-4857's guard); `radeon.ko` rebuilt **under -Werror**:
  compile+link OK (`radeon_fix_apply.log`, `radeon_module_build.log`).
- Harness fixed-build reruns both scenarios cleanly.
- Guest `/usr/src` reverted afterwards (md5 verified pristine).

## Notes

- DF-1937 (ss.rate==0/clk_s==0 div0 at :97/:173) is the neighboring code in
  the same block and is NOT re-reported here; this finding is solely the
  wrong-destination store of the already-computed clk_v.
- `vco_freq = memory_clock * post_divider` (:168) can wrap u32 on crafted
  mclk — only used as the SS-table match key (worst case: wrong entry
  selected) — noted, not filed.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.