AMD PSP reverse engineering, emulator and vulnerability research https://git.sl0p.foo/amd-psp-re.git/atom/smu?h=main 2026-09-28T13:47:22Z 2026-09-28T13:47:22Z user user@clank 2026-09-28T13:47:22Z urn:sha1:cb6f03125e019955912baa45faa9359da1d810db SMU is the other big host-facing microcontroller, and several PPSMC_MSG_* arguments are indices -- the shape that produced DMCUB FINDING-2. Probed directly on the card, read-direction only. TransferTableSmu2Dram rejects every table_id >= TABLE_COUNT (positive control: six in-range ids returned data into the driver DRAM buffer). GetDpmFreqByIndex bounds both the clock id and the level. GetVoltageByDpm is a deterministic quadratic curve evaluation, not an indexed load. Two near-misses are recorded rather than banked: GetDpmFreqByIndex accepting 0x100/0xffff is 8-bit masking aliasing, and GetVoltageByDpm's alarming 0xffff -> 0x1e3f2a is arithmetic. TransferTableDram2Smu was deliberately not probed; an out-of-range id in the write direction risks wedging the SMU.