DF-4039 — polaris10_get_dependency_volt_by_clk fall-through reads dep_table->entries[count] twice (one-entry heap OOB read)

File: sys/dev/drm/amd/powerplay/smumgr/polaris10_smumgr.c Severity: Low | Class: CWE-125 Out-of-bounds Read Status: hardware-gated — source-certain; runtime reproduction impossible on the audit guest (no Polaris GPU / no AMD53C974 HBA — see env.txt). Verdict: inconclusive, confidence certain.

Build & run (on the DragonFly guest)

./build.sh     # compiles the demonstrator (uses the guest's kernel headers)
./run.sh       # reproduces the exact index arithmetic / branch selection

Expected: the DF-4039 section of run.log shows the OOB offsets / panic-branch selection / fault. Full guest details in env.txt.

Fix validation

fix.diff applied (with all DF-4036..DF-4044 patches together) to a clean guest /usr/src copy; make nativekernel KERNCONF=X86_64_GENERIC completed with 0 errors under -Werror (see fix_build.log — polaris10_smumgr.o recompiled). Sources restored to pristine afterwards (md5-verified).

DF-4039 VERDICT — polaris10_get_dependency_volt_by_clk fall-through reads dep_table->entries[count] twice (one-entry heap OOB read)

Bottom line

Source-certain one-entry heap OOB reads (x2) in the fall-through tail of polaris10_get_dependency_volt_by_clk (polaris10_smumgr.c:396-411), exact fiji DF-4005 copy: when the requested clock exceeds every entry the loop exits with i == dep_table->count, then :403 reads entries[i].vddc (feeds phm_find_closest_vddci -> MinVoltage programmed to SMU) and :410 reads entries[i].mvdd as a branch condition. entries[] is allocated with exactly count records, so both reads consume adjacent-slab bytes. Demonstrated: run.log DF-4039 (phantom 0x42 byte consumed). Hardware-gated -> runtime inconclusive, source certain.

Exploit chain

crafted vBIOS dep table + a clock request above all entries (ACPI/boot levels, :1214/:1249 call sites) -> fall-through tail -> entries[count] reads past the heap object

Why not reproduced on the guest

The audit guest is QEMU/KVM with virtio display only: no AMD GPU, /dev/dri absent (env.txt), so polaris10_powerplay never binds — the crafted-VBIOS trigger cannot be exercised at runtime. The index arithmetic and struct geometry are proven against the kernel headers compiled verbatim (run.log), and the fix is compile-validated (fix_build.log).

Negative results recorded alongside (pass-2 depth)

Checklist item kills: LinkLevel i<=count walk is bounded (pcie count clamped to <=7 at smu7_hwmgr.c:561-569); mc_reg-table walks are not in this file (smu7_smumgr.c owns them); fan-table div0 is known DF-1345; VCE/UVD count overflow is known DF-1346; Smio[32] and SmioTable.Pattern[4] walks are correctly clamped (SMU_MAX_SMIO_LEVELS).

Fix

Use entries[i - 1] in both fall-through reads (fix.diff, mirrors the fiji fix). Applied and compile-validated on the guest (fix_build.log); sys/ tree never modified by the audit.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.