# PoC DF-1575: process_pptables_v1_0 NULL deref when vdd_dep_on_sclk missing

**Class:** NULL pointer deref
**Cited site:** `sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:794,808-810,816-818,843-845,522,745`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

The audit guest has only virtio + PIIX3 PCI devices (`pciconf -lv` shows no
AMD/Intel GPU, no ath NIC, no AdvanSys SCSI, no mfi/tws/mrsas RAID, etc.),
so the cited code path is not reachable at runtime on this guest.

The bug is **confirmed at the source level** by tracing the cited path:line
in `sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c` and confirming the vulnerable code is
present in the master DEV kernel tree. The `fix.diff` in this folder is
validated to apply cleanly and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

init_clock_voltage_dependency: vdd_dep_on_sclk NULL when usSclkDependencyTableOffset==0 (794). get_pcie_table 522 pcie_count = vdd_dep_on_sclk->count + 1 NO NULL check -> panic. get_gpio_table 745 derefs vdd_dep_on_sclk->count NO NULL check. GPIO table pointer at 790-792 non-NULL even when offset==0 (equals powerplay_table) so gate at 843 never filters.

## Realistic impact ceiling (on suitable HW)

deterministic NULL deref panic via crafted VBIOS (root pp_table sysfs or malicious VFIO)

## Fix

NULL-guard vdd_dep_on_sclk at the top of get_pcie_table and get_gpio_table; return -EINVAL if absent.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```sh
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1575.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 --forward < /root/DF-1575.diff'
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && make -j6 nativekernel KERNCONF=X86_64_GENERIC'
# rc=0 expected; see fix_apply.log + fix_build.log in this folder.
```