DF-5137 — radeon kv_smc.c: fail-open SMC response validation
==============================================================

**File:** `sys/dev/drm/radeon/kv_smc.c:30-52` (radeon twin of DF-5132, amdgpu)

**What:** `kv_notify_message_to_smu()` validates the SMC response by rejecting
ONLY the literal values `0xFF` and `0xFE`. A wait-loop timeout (response
`0x0000` = "no response yet") and every undefined response code fall through
to `return 0` = success. On radeon the hole is WIDER than the amdgpu twin:
`SMC_RESP_MASK` is `0xffff` (cikd.h:431), so the response register is compared
as a 16-bit value and the literals only match `0x00FF`/`0x00FE` — e.g. a
byte-swapped `FAILED` (`0xFF00`) or any `0x0102..0xFFFD` also reports success.

**Impact:** the whole kv_dpm.c power-management state machine (37 call sites)
proceeds against a wedged SMC believing every message succeeded (DPM enable,
BAPM enable, table uploads); `kv_dpm_get_enable_mask()` (kv_smc.c:54-64) then
reads the message-ARG register as a "valid" enable mask after a timed-out
query. No attacker-controlled input reaches this path and the SMC SRAM write
path fails closed (see VERDICT.md kill trace), so the ceiling is PM
desynchronization / GPU hang on already-faulted hardware => **Info**,
matching DF-5132.

## Reproduce (static proof; runtime needs Kaveri APU silicon)

```sh
sh check_static.sh /home/maxx/dfbsd/dfbsd     # 11 assertions, all must PASS
cat check_static.log
```

Runtime reproduction is hardware-gated: the audit QEMU guest has zero AMD/ATI
PCI devices (`pciconf -l | grep -icE 'ati|amd|1002'` → 0, see env.txt) and the
trigger additionally needs a Kaveri-class APU with a stalled SMC.

## Fix

`fix.diff` (git-apply clean against the unmodified tree) replaces the
0xFF/0xFE whitelist with fail-closed rejection of everything !=
`PPSMC_Result_OK`, mirroring the DF-5132 fix for the amdgpu twin.
`fix_build.log` is the full `radeon.ko` build with the fix applied
(compiles clean with `-Werror`; kv_smc.o linked).

## Files

- `check_static.sh` / `check_static.log` — mechanical static proof
- `fix.diff` — the fix, unified diff
- `fix_build.log` — radeon.ko compile-validation of the fix (guest /usr/src)
- `env.txt` — guest environment (no AMD hardware)
- `manifest.json`, `verdict.json`, `VERDICT.md`