# DF-4905 — VERDICT

**status: untested · reproduced: 0 · impact: none (OOB read gated on firmware control) · confidence: speculative (code certain)**

## Narrative

`k8pnow_states()` (powernow.c:167-202) trusts two BIOS-provided counters
after finding the `"AMDK7PNOW!"` signature: `psb->n_pst` (u8) and, per
iteration, `pst->n_states` (u8).  The advance
`p += sizeof(struct pst_s) + 2 * cstate->n_states` (powernow.c:196-197)
is performed `n_pst` times with **no** check that `p` stays below
`BIOS_PADDRTOVADDR(BIOS_START + BIOS_LEN)`.  Maximum overshoot:
255 * (8 + 510) ≈ 132 KB past physical 0x100000, which via
`BIOS_PADDRTOVADDR(x) = (x) + KERNBASE` (bios.h:36) is the kernel's own
text/data — reads succeed silently.  On a fortuitous match of
`cpuid/fid/vid` (powernow.c:191-192), `k8pnow_decode_pst()` receives an
interior kernel pointer and an attacker-influenced `n_states` whose only
bound is the already-known DF-1961 defect (heap OOB write).

Threat model equals the known DF-1960/DF-1961 family: requires a
corrupted or attacker-reflashed BIOS (or hostile VM firmware presenting
K8 CPUID) — not reachable from the OS itself.  Hence Low/speculative.

## Verification

Not runtime-testable: the audit guest is Intel/QEMU; `kldload powernow`
prints `MOD_LOAD error 2` (CPUID gate, powernow.c:361-363) and the scan
never executes (env.txt).  No harness can exercise BIOS memory content
from the OS side; analysis pack only.

## Fix

`fix.diff`: two window checks — before dereferencing `pst` and before
calling the decoder — bail out (`return 0`) when the header or the
2*n_states state array would cross the window end.  Applies cleanly.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.