# DF-4904 — VERDICT

**status: untested · reproduced: 0 · impact: dos (malformed MSR write / #GP panic on K8) · confidence: likely**

## Narrative

`k8_powernow_setperf()` Phase 1 lowers the core voltage in steps of
`1 << cstate->mvs` (powernow.c:260-266).  `val` is declared `uint32_t`
(powernow.c:231) but `cvid - (1 << cstate->mvs)` is `int` arithmetic:
when the current VID is below one step (cvid=1, mvs=2 ⇒ −3), the value
wraps to 0xFFFFFFFD on assignment.  The clamp `(val > 0) ? val : 0`
(powernow.c:262) is dead code for unsigned types — 0xFFFFFFFD > 0 — so
`WRITE_FIDVID` (powernow.c:76-78) composes
`(1ULL<<32)|(1<<16)|(0xFFFFFFFD<<8)|cfid` = `0x000000fffffffd0a` and
writes it to MSR 0xc0010041: VID field gets 0x1d instead of 0, and bits
13-31 (reserved/control) get pure garbage.

Effect on K8 silicon: #GP on wrmsr (kernel panic at CPL 0) or
misprogrammed FID/VID transition control.  Reachable (a) at module load
through the DF-4903 route (powernow_init:392 drives vid→0), or (b) when
root writes a lower frequency to `machdep.powernow.frequency.target`
(writes are privilege-gated, kern_sysctl.c:1446).

## Verification

Kernel-level: impossible on this guest — QEMU/Intel CPU, module gate at
powernow.c:358-363 refuses (`MOD_LOAD error 2`, env.txt).  Logic-level:
`sim_vidunderflow.c` run as uid=1001 reproduces the exact arithmetic and
prints the malformed MSR word (run.log).  Not counted as reproduction.

## Fix

`int32_t val` makes the existing clamp effective (fix.diff, applies
clean).  Fix build/validation not run (needs K8).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.