[FIRMWARE BUG REPORT] OMEN 17-db1476ng (C3BE7EA) – ACPI AML Array Index Out-of-Bounds (Buffer Overfl

[indycar_si]

[FIRMWARE BUG REPORT] OMEN 17-db1476ng (C3BE7EA) – ACPI AML Array Index Out-of-Bounds (Buffer Overflow) in DSDT Table

Applies to: HP OMEN 17-db1476ng (and related AMD-based OMEN 17 platforms sharing this firmware base).
Severity: Medium (Causes ACPI thread aborts, impacting hardware thermal/fan control and power profile switching under strict ACPI parsers like the Linux kernel).

Description of the Bug

There is an off-by-one index boundary violation hardcoded into the DSDT ACPI table. The firmware defines data buffer objects with hardcoded lengths (specifically lengths of 0x80 and 0x32 bytes), but subsequent execution methods attempt to read/write explicitly at Index 0x80 and Index 0x32. Because ACPI Machine Language (AML) utilizes zero-based indexing, trying to access index N on an array of length N causes an out-of-bounds evaluation.

Strict compliance parsers flag this as an AE_AML_BUFFER_LIMIT fault and immediately terminate the corresponding evaluation thread. This directly prevents OS-level daemons from interacting with HP WMI features such as fan curve modifications, thermal sensor feedback, and hardware-level performance profile shifting.

Exact Code Reference (Decompiled DSDT.dsl)

The fault originates directly inside the following defined ACPI method:

• Line Reference: Line 19458 (approximate depending on exact minor BIOS iteration)
• Target Method: Method (WMBX, 3, NotSerialized)
• Related Methods Blocked by Chain Failure: \_SB.WMID.WMBX, \_SB.WMID.WMBA, \_SB.WMID.WQBZ, \_SB.WMID.WQBE

Kernel Error Logs (Reproducible on Boot)

ACPI BIOS Error (bug): AE_AML_BUFFER_LIMIT, Index (0x000000080) is beyond end of object (length 0x80) (20260408/exoparg2-393)
ACPI Error: Aborting method \_SB.WMID.WMBX due to previous error (AE_AML_BUFFER_LIMIT) (20260408/psparse-545)
ACPI Error: Aborting method \_SB.WMID.WMBA due to previous error (AE_AML_BUFFER_LIMIT) (20260408/psparse-545)
...
ACPI BIOS Error (bug): AE_AML_BUFFER_LIMIT, Index (0x000000032) is beyond end of object (length 0x32) (20260408/exoparg2-393)
ACPI Error: Aborting method \_SB.WMID.WQBZ due to previous error (AE_AML_BUFFER_LIMIT) (20260408/psparse-545)

Requested Fix for Engineering Team

In the next firmware release cycle, please pass this to the BIOS/UEFI engineering team to alter the DSDT compilation parameters:

1. Increase the defined buffer size constraint for the evaluation objects inside the WMID sub-scope to safely accommodate the boundary check (e.g., increase object length definition from 0x80 to 0x81, and 0x32 to 0x33).
2. Alternatively, correct the loop bounds logic within WMBX and WQBZ so that the index pointer terminates at Length - 1 (e.g., matching the zero-based array ceiling).

#### Root Cause Analysis (Code Level)
The out-of-bounds array exception triggers specifically within the double-increment pointer tracking logic inside `Method (WMBX)`:

While ((Local5 != Local4))
{
ST01 [Local6] = DerefOf (Local0 [Local2])
Local2++
Local5++
Local6++
Local2++ <-- Pointer index increments sequentially twice per iteration loop
Local5++ <-- Loop counter increments sequentially twice per iteration loop
}

Because Local2 increments unconditionally without validating if (Local2 < SizeOf(Local0)) before the secondary increment step, an index out-of-bounds exception (AE_AML_BUFFER_LIMIT) is guaranteed when parsing non-aligned memory lengths mapped to this query buffer interface.

#### Root Cause Analysis - Part 2 (WQBZ Data Query Fault)
An additional array boundary breach occurs within `Method (WQBZ)` when evaluating system state query blocks:

While ((Local5 != N018))
{
Local7 = DerefOf (DerefOf (N013 [Local5]) [Zero])
...
}

The nested loop uses 'Local5' to iterate through the 'N013' global package array (which has a hardcoded allocation length of exactly 0x32 bytes). However, the loop's upper bounds constraint mistakenly checks against the independent state variable 'N018' rather than pulling the true boundary constraint from SizeOf(N013).

Because the evaluation bounds are uncoupled from the actual object size, an out-of-bounds pointer index violation (Index 0x32 on Object Length 0x32) triggers immediately, causing an 'AE_AML_BUFFER_LIMIT' crash that unbinds core WMI data methods.

[Pallipurath]

Hi @indycar_si 

Welcome to the HP Support Community.

Thank you for posting your query.

I appreciate the level of investigation performed, including the ACPI table decompilation, identification of the affected methods, and the correlation with the reproducible AE_AML_BUFFER_LIMIT kernel messages.

To help us better understand the scope and impact of the reported behavior, could you provide some additional information about the environment in which the issue is occurring?

Specifically, have you observed any end-user-visible hardware symptoms that correlate with these ACPI method failures? For example, are there any issues with fan operation, thermal management, power profile transitions, performance mode switching, sensor reporting, battery behavior, or sleep/resume functionality? Or is the issue currently limited to the ACPI errors reported by the operating system logs?

It would also be helpful to know the operating system details. Which Linux distribution and version are being used, and which kernel version(s) have been tested? Do the AML exceptions occur immediately during boot, or only after a service or application attempts to access the affected HP WMI interfaces?

Regarding software interaction, what application, service, or subsystem initially exposed the problem? Are you seeing the failures while using a specific fan-control utility, thermal management application, OMEN-related software, hardware monitoring tool, or through direct ACPI/WMI interaction? If applicable, which features become unavailable after the affected methods (WMBX, WMBA, WQBZ, WQBE) abort?

For completeness, could you also confirm the BIOS revision currently installed on the OMEN 17-db1476ng and whether the issue has been observed across multiple BIOS versions or only on a specific release?

Finally, is the platform otherwise operating normally apart from the reported ACPI exceptions, or have you identified measurable impacts to thermal control, fan curves, performance profiles, or other hardware-management features that can be directly linked to these aborted AML evaluations?

Take care and have an amazing day!

[indycar_si]

Thank you for the thorough and prompt technical escalation. Please find the exact environmental metrics, reproducing parameters, and measurable hardware impacts for the OMEN 17-db1476ng (C3BE7EA) firmware fault detailed below:

1. Operating System & Kernel Environment

• Distribution: CachyOS Linux (Arch Linux-based platform utilizing advanced kernel optimizations).
• Kernel Versions Tested: Linux Kernel 6.11.x / 6.12.x (Tested on strict compliance upstream kernels).
• Exception Timing: The initial AE_AML_BUFFER_LIMIT exceptions occur immediately during the early boot phase as the kernel parser maps and evaluates the ACPI namespace definitions. Secondary cascade abort events fire continuously whenever user-space daemons trigger system-bus polling via the /sys/bus/wmi/ hardware interface.

2. Software Interaction & Initial Exposure

• Subsystem/Application: The problem was initially exposed via standard kernel platform telemetry, but manifests directly through community hardware management abstractions like the open-source OMEN Space (omenctl) daemon and the native power-profiles-daemon subsystem.
• Affected Subsystems: When \_SB.WMID.WMBX and \_SB.WMID.WQBZ abort due to the index-out-of-bounds boundary failure, the OS layer loses the ability to safely make direct hardware calls to the Embedded Controller (EC) registers mapped to these proprietary interfaces.

3. End-User Visible Hardware Symptoms & Measurable Impacts

The impact is not limited to diagnostic log noise. The programmatic thread aborts trigger distinct, tangible operational malfunctions:

• Thermal Management & Fan Lockups: Because the system-bus telemetry is dropped mid-thread during array parsing, the platform loses dynamic fan curve steering. Fans frequently become locked or stuck at a static RPM percentage (either staying at low speeds under high CPU loads causing throttling, or getting pinned at maximum 100% duty cycle indefinitely until a cold reboot).
• Power Profile Switching Failures: Toggling performance states (e.g., Performance, Balanced, ECO) via the operating system power management interface fails to pass down instructions cleanly. This results in the CPU getting trapped inside sub-optimal clock-rate steps because the underlying ACPI power switching routines (_GRT and related hooks) abort early.
• Sleep/Resume Loop Degradations: Tied closely with the related VRTC / SystemCMOS region handler errors flagged in the exact same log trace, power state transitions to ACPI S3/S0ix Suspend (Sleep Mode) cause system instability, hard freezes during wake-up loops, or improper background battery drain while suspended.

4. Platform Identification & BIOS Revision

• Product: OMEN by HP Laptop 17-db1476ng (C3BE7EA)
• BIOS Revision: F.20 Rev.A (Released May 8, 2026)
• Cross-Version Presence: This off-by-one pointer loop design flaw has persisted sequentially across several recent historical revision cycles, as the same buggy While logic loops inside WMBX have been carried forward across unified firmware code trees for modern AMD-based OMEN footprints.

Conclusion

While the platform functions on less rigid OS runtime environments (like Windows) that silently bypass array buffer overruns, strict, standard-compliant operating systems completely unbind these WMI structures because the double-increment pointer arithmetic is fundamentally invalid code logic.

[Pallipurath]

Hi @indycar_si 

Thank you for providing the detailed technical information.

Please note that HP has limited support for Linux operating systems, and we may not be able to provide in-depth troubleshooting for Linux-specific ACPI/WMI errors or kernel-related issues.

We recommend contacting the CachyOS/Linux support community for further assistance in analyzing the ACPI exceptions and investigating their potential impact on fan control, power management, and suspend/resume functionality.

Have a good day.