DF-4036 — Unclamped VBIOS SCLK/MCLK DPM counts overflow polaris10 SMC GraphicsLevel[8]/MemoryLevel[4] and the 384-byte STACK MC-arb timing table

File: sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c Severity: High | Class: CWE-787 Out-of-bounds Write Status: hardware-gated — source-certain; runtime reproduction impossible on the audit guest (no Polaris GPU / no AMD53C974 HBA — see env.txt). Verdict: inconclusive, confidence certain.

Build & run (on the DragonFly guest)

./build.sh     # compiles the demonstrator (uses the guest's kernel headers)
./run.sh       # reproduces the exact index arithmetic / branch selection

Expected: the DF-4036 section of run.log shows the OOB offsets / panic-branch selection / fault. Full guest details in env.txt.

Fix validation

fix.diff applied (with all DF-4036..DF-4044 patches together) to a clean guest /usr/src copy; make nativekernel KERNCONF=X86_64_GENERIC completed with 0 errors under -Werror (see fix_build.log — polaris10_smumgr.o recompiled). Sources restored to pristine afterwards (md5-verified).

DF-4036 VERDICT — Unclamped VBIOS SCLK/MCLK DPM counts overflow polaris10 SMC GraphicsLevel[8]/MemoryLevel[4] and the 384-byte STACK MC-arb timing table

Bottom line

Source-certain kernel heap + stack OOB writes, iceland/fiji DF-4000/DF-4001 family on SMU74: the SCLK/MCLK dpm counts flow unclamped from the VBIOS PowerPlay dependency tables (process_pptables_v1_0.c ucNumEntries u8<=255 -> smu7_hwmgr.c:783-810 dpm_table.*.count, no clamp) into polaris10_populate_all_graphic_levels (polaris10_smumgr.c:1000-1017, GraphicsLevel[8] writes + GraphicsDpmLevelCount truncation that re-feeds update_dpm_settings:2427), polaris10_populate_all_memory_levels (:1138-1148, MemoryLevel[4] writes incl. the [count-1] DisplayWatermark/EnabledForActivity stores at :1145-1148, MemoryDpmLevelCount truncation) and polaris10_program_memory_timing_parameters (:1365-1380, the 384-byte STACK SMU74_Discrete_MCArbDramTimingTable arb_regs with entries[8][4]: mclk count 5+ corrupts entries[i+1] rows silently and runs off the table at i==7,j>=4 or i>=8; sclk/mclk 255/255 reaches 15300B past). Demonstrated on the guest with the kernel headers: run.log DF-4036a/b/c (224B/48B redzone dirty at counts 12/6; 26 stack-entry writes past the 32-entry table). Hardware-gated: no Polaris GPU on the audit guest -> runtime inconclusive, source certain.

Exploit chain

crafted vBIOS PowerPlay table with sclk/mclk dependency ucNumEntries > 8/4 -> dpm tables -> polaris10 populate walks -> heap OOB writes in struct polaris10_smumgr (kzalloc) + kernel stack smash past the 384B arb_regs local

Why not reproduced on the guest

The audit guest is QEMU/KVM with virtio display only: no AMD GPU, /dev/dri absent (env.txt), so polaris10_powerplay never binds — the crafted-VBIOS trigger cannot be exercised at runtime. The index arithmetic and struct geometry are proven against the kernel headers compiled verbatim (run.log), and the fix is compile-validated (fix_build.log).

Negative results recorded alongside (pass-2 depth)

Checklist item kills: LinkLevel i<=count walk is bounded (pcie count clamped to <=7 at smu7_hwmgr.c:561-569); mc_reg-table walks are not in this file (smu7_smumgr.c owns them); fan-table div0 is known DF-1345; VCE/UVD count overflow is known DF-1346; Smio[32] and SmioTable.Pattern[4] walks are correctly clamped (SMU_MAX_SMIO_LEVELS).

Fix

Clamp every SCLK/MCLK-driven walk to SMU74_MAX_LEVELS_GRAPHICS/MEMORY and SMU__NUM_SCLK_DPM_STATE/SMU__NUM_MCLK_DPM_LEVELS, index dpm_levels modulo MAX_REGULAR_DPM_NUMBER, and store clamped min() into the *DpmLevelCount fields (fix.diff). Applied and compile-validated on the guest (fix_build.log); sys/ tree never modified by the audit.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.