# PoC DF-1497: ppatomctrl_get_svi2_voltage_object GPU NULL deref

**Class:** NULL pointer dereference (DoS)
**Cited site:** `sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:1444-1449`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

No — amdgpu powerplay HW-gated. Trigger requires a GPU VBIOS with no SVID2 voltage object matching the requested voltage_type.

The bug is **confirmed at the source level** by tracing the cited path:line in
`sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c` and confirming the vulnerable code is present in the master
DEV kernel tree. The `fix.diff` in this folder is validated to apply cleanly
and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

Line 1441-1442 only guards `voltage_info` (the table) — that pointer is checked. Line 1444-1445 `voltage_object = atomctrl_lookup_voltage_type_v3(...)` returns NULL at ppatomctrl.c:238 when no voltage object matches (voltage_type, VOLTAGE_OBJ_SVID2). Lines 1447-1449 unconditionally deref `voltage_object->asSVID2Obj.ucSVDGpioId/ucSVCGpioId/usLoadLine_PSI` → NULL deref → kernel panic.

## Realistic impact ceiling

panic (DoS)

## Fix

Add `if (voltage_object == NULL) return -EINVAL;` between the lookup and the first deref.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```
# 1. Apply fix.diff against the in-guest source:
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1497.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 < /root/DF-1497.diff'

# 2. Rebuild the affected module (preferred) or a single-fix kernel:
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src/sys/sys/dev/drm/amd/powerplay/hwmgr && make'

# 3. The compile must succeed with -Werror (it does — see build.log).
```