DF-4005 — fiji_get_dependency_volt_by_clk fall-through reads dep_table->entries[count] (one-entry heap OOB read ×2)

File: sys/dev/drm/amd/powerplay/smumgr/fiji_smumgr.c:404-414 (reads at :406 and :413) Class: kernel heap OOB read (kernleak-class; value used only as a branch condition) Severity: Low · Confidence: certain (source) · runtime hardware-gated

Build / Run / Expected

Same demonstrator as DF-4001 (./build.sh && ./run.sh, section === DF-4005 ===):

count=3, i=3 after fall-through; entries[i].mvdd reads bytes at +60, 12 bytes past the 3-entry heap object
value read = 0x0001 (poisoned adjacent-slab byte) — kernel heap adjacent-slab bytes consumed as a branch condition

Source chain

When the requested clock exceeds every entry (loop :368-396 falls through), i == dep_table->count and the tail block reads - :406 dep_table->entries[i].vddc (inside the vddci lookup), - :413 dep_table->entries[i].mvdd (mvdd condition), both one entry past the kmalloc(count * sizeof(entry)) allocation made in process_pptables_v1_0.c:425-436/378-391. The in-bounds twin reads correctly use entries[i - 1] (:399, :404, :414). The OOB bytes only select whether *mvdd gets set — no direct disclosure, but a genuine heap OOB read on the hot per-level voltage path. Carried from the upstream 4.x code as-is.

Fix

fix.diff (shared): use entries[i - 1] at both sites. Compile-validated via nativekernel rebuild (fix_build.log).

VERDICT — DF-4005

Status: inconclusive at runtime (hardware-gated); source-certain.

Demonstrated (run.log, section DF-4005): the fall-through tail of fiji_get_dependency_volt_by_clk (fiji_smumgr.c:398-416) executes with i == dep_table->count when the requested clock exceeds every entry; it reads dep_table->entries[i].vddc at :406 and dep_table->entries[i].mvdd at :413 — one entry (12 B of a 16 B record) past the exact-size heap allocation made by process_pptables_v1_0.c:425-436/378-391. The demonstrator's poisoned redzone byte (0x0001) shows adjacent-slab content being consumed as the branch condition that decides whether *mvdd is populated. All sibling reads in the same block correctly use entries[i - 1] (:399/:404/:414) — an off-by-one carried from the 4.x upstream code. Impact is a bounded kernel heap OOB read with no direct disclosure channel → Low.

Called on every graphics/memory level population (:957, :1181) — hot path, not error path. Hardware-gated (env.txt).

Fix: fix.diff uses entries[i - 1] at both sites; nativekernel rebuild OK (fix_build.log), reverted.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.