# DF-1039 — pccard_safe_quote NULL deref

## Summary
`pccard_safe_quote` at `sys/bus/pccard/pccard.c:1001` dereferences `*src`
without checking for NULL. `pccard_child_pnpinfo_str` (`:1020-1021`) passes
`sc->card.cis1_info[0]`/`[1]` directly, but these are initialized to NULL
in `pccard_cis.c:86-89` and only assigned when the card CIS contains a
`VERS_1` tuple. A VERS_1-less PC Card → NULL deref → kernel panic.

## HW / preconditions
Requires a PCMCIA bridge + a malicious/quirky PC Card without a VERS_1
tuple. **Not present in the QEMU audit guest** — code-confirmed only.

## Build / Run
No buildable PoC (no PCMCIA HW). `./build.sh && ./run.sh` print the
situation. The bug is documented in `pccard_null_deref.c`.

## Fix
`fix.diff` adds a NULL guard at the top of `pccard_safe_quote`, matching
every other `cis1_info` consumer.