β¬’ DragonFlyBSD Kernel Audit
← triage Β· dashboard
DF-3625

ci_dpm_force_performance_level passes the AMD_DPM_FORCED_LEVEL_HIGH enum value (8) instead of the computed top index to ci_dpm_force_state_pcie

Summary

In the AMD_DPM_FORCED_LEVEL_HIGH branch, 'levels' is computed as the index of the highest enabled pcie level, but the call uses 'level' == AMD_DPM_FORCED_LEVEL_HIGH == 0x8 - out of range for the 6-entry pcie table. The sclk/mclk branches correctly use 'levels'. The subsequent poll waits for CURR_PCIE_INDEX == levels and always spins to timeout. The radeon twin at radeon/ci_dpm.c:4255 has the same typo. Root-writable sysfs 'high' -> out-of-range SMC message + bounded busy-wait; firmware-side misbehavior only, no kernel memory-safety impact.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-3625 Β· 1 files
FileTypeDescriptionSize
verdict.json file 315 B view raw

Confirmed kernel references

β€”

Detail

Evidence (decisive lines)

β€”

Verdict

Info - root-only sysfs; no kernel memory-safety impact; source-certain variable confusion.