|
|
SMU is the other big host-facing microcontroller, and several PPSMC_MSG_*
arguments are indices -- the shape that produced DMCUB FINDING-2. Probed
directly on the card, read-direction only.
TransferTableSmu2Dram rejects every table_id >= TABLE_COUNT (positive control:
six in-range ids returned data into the driver DRAM buffer). GetDpmFreqByIndex
bounds both the clock id and the level. GetVoltageByDpm is a deterministic
quadratic curve evaluation, not an indexed load.
Two near-misses are recorded rather than banked: GetDpmFreqByIndex accepting
0x100/0xffff is 8-bit masking aliasing, and GetVoltageByDpm's alarming
0xffff -> 0x1e3f2a is arithmetic. TransferTableDram2Smu was deliberately not
probed; an out-of-range id in the write direction risks wedging the SMU.
|
