kern/60902: Overflow in dbcool when setting voltage limit

["joe%ns1.eloisystems.com@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60902
>Category:       kern
>Synopsis:       Overflow in dbcool when setting voltage limit
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Oct 18 20:55:00 +0000 2026
>Originator:     Emmanuel Nyarko
>Release:        NetBSD current
>Organization:
NetBSD
>Environment:
NetBSD celery.zia.io 11.0_STABLE NetBSD 11.0_STABLE (GENERIC) #0: Fri Aug 21 06:09:16 UTC 2026  john%celery.zia.io@localhost:/usr/obj-amd64/sys/arch/amd64/compile/GENERIC amd64
>Description:

dbcool driver keeps a int64_t nominal voltage array containing values in million ranges.

in setting voltage limits based on these nominal voltages, the values are multiplied by 

 1 million to scale in micorvolts and stored in ints.


8 of these values overflow the integer storing the voltage nom.
>How-To-Repeat:

from code inspection
>Fix:

Index: sys/dev/i2c/dbcool.c
===================================================================
RCS file: /cvsroot/src/sys/dev/i2c/dbcool.c,v
retrieving revision 1.70
diff -u -r1.70 dbcool.c
--- sys/dev/i2c/dbcool.c        3 Sep 2026 05:32:06 -0000       1.70
+++ sys/dev/i2c/dbcool.c        18 Oct 2026 20:48:49 -0000
@@ -2019,7 +2019,7 @@
 {
        struct reg_list *reg = sc->sc_regs[idx];
        int64_t limit;
-       int nom;
+       int64_t nom;
 
        nom = nominal_voltages[sc->sc_dc.dc_chip->table[idx].nom_volt_index];
        if (nom < 0)
@@ -2154,7 +2154,7 @@
 {
        struct reg_list *reg = sc->sc_regs[idx];
        int64_t limit;
-       int nom;
+       int64_t nom;
 
        nom = nominal_voltages[sc->sc_dc.dc_chip->table[idx].nom_volt_index];
        if (nom < 0)
joe@Emmanuels-MBP src %