DF-1269 PoC — kv_parse_power_table missing bounds checks (LATENT)

Status: source-confirmed real (certain); NOT reproducible on audit guest (no AMD GPU). Impact: OOB read from BIOS mapping via crafted VBIOS indices. Driver: sys/dev/drm/amd/amdgpu/kv_dpm.c (amdgpu kv path, not in GENERIC, no HW).

Reproduce

./build.sh && ./run.sh   # stub; bug path is VBIOS power-table parse

See VERDICT.md + fix.diff.

DF-1269 — kv_parse_power_table missing bounds checks on VBIOS indices (LATENT)

Verdict

NOT REPRODUCED on the audit guest (LATENT / HW-gated). The bug is confirmed real by source-level trace (confidence=certain in the DB); it cannot fire here because there is no AMD APU/GPU, so the kv_dpm.c power-table parse path is dead at runtime.

Mechanism (confirmed in source)

kv_parse_power_table (kv_dpm.c:~2710) reads VBIOS-supplied indices without bounds checks against ucNumEntries: - nonClockInfoIndex (kv_dpm.c:2745-2747): non_clock_array_index = power_state->v2.nonClockInfoIndex; (u8 from VBIOS), then &non_clock_info_array->nonClockInfo[non_clock_array_index] — no check non_clock_array_index < non_clock_info_array->ucNumEntries → OOB read from the BIOS mapping. - vce_states clk_idx (kv_dpm.c:2780-2782): clock_array_index = adev->pm.dpm.vce_states[i].clk_idx; (range 0..63), then &clock_info_array->clockInfo[clock_array_index * ucEntrySize] — no check vs ucNumEntries. - The sibling clock-info path at :2758 (if (clock_array_index >= clock_info_array->ucNumEntries) continue;) does check — proving these two were missed.

A crafted VBIOS → OOB read from the BIOS mapping → panic or leak into sysfs-visible rps fields.

Why it does not reproduce here

No AMD GPU on the guest (pciconf -lv); kv_dpm attaches only to AMD APUs. Reaching the bug needs that hardware + a crafted VBIOS. Valid hard blocker.

Exploit chain

N/A — OOB read (info leak / panic), HW-gated (latent). No write primitive.

PoC changes

trigger.c is a documentation stub.

Fix (fix.diff)

Add the two missing bounds checks, mirroring the existing :2758 check: - skip the state if non_clock_array_index >= non_clock_info_array->ucNumEntries (advance power_state_offset and continue); - skip the vce state if clock_array_index >= clock_info_array->ucNumEntries. Applies cleanly (patch -p1 rc=0). Matches the finding proposal.

Fix validation

not_testable — code path unreachable on audit guest; diff applies cleanly, syntactically reviewed.