AMD PSP reverse engineering, emulator and vulnerability research https://git.sl0p.foo/amd-psp-re.git/atom/hw/app_range.py?h=main 2026-09-30T00:07:50Z 2026-09-30T00:07:50Z user user@clank 2026-09-30T00:07:50Z urn:sha1:3b113480f033336b9fd7daa857e9f81ed0b14173 The last unfuzzed descriptor field is the image source. If unchecked, pointing it at the trusted region would pull trusted memory into the authentication path. Testing shows it is range-checked exactly as the command buffer is: an image inside the region and one straddling its start are both rejected, while a control and an oversized length that stays within our allocation are accepted, and a zero-length image is rejected cleanly with an error code. That sharpens the earlier finding. Within one descriptor, a zero-length image yields a clean error while a zero-length command buffer yields a hang, so the platform knows how to reject this input class and the command-buffer length is simply missing the check. That is a concrete narrow defect to report rather than a vague intermittent hang. The whole load descriptor surface is now fuzzed, giving two correct range checks, one clean zero-length rejection and one missing check that produces a denial of service, with no memory corruption anywhere in it.