diff --git a/sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c b/sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c
--- a/sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c
+++ b/sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c
@@ -499,6 +499,15 @@
 	struct phm_ppt_v1_information *pp_table_information =
 		(struct phm_ppt_v1_information *)(hwmgr->pptable);
 	phm_ppt_v1_pcie_record *pcie_record;
+
+	/*
+	 * DF-1575: pp_table_information->vdd_dep_on_sclk is only populated
+	 * when usSclkDependencyTableOffset != 0; with a crafted VBIOS that
+	 * has a PCIE table but no SCLK dependency table, dereferencing
+	 * vdd_dep_on_sclk->count below would NULL-deref.  Bail out.
+	 */
+	if (!pp_table_information->vdd_dep_on_sclk)
+		return -EINVAL;
 
 	if (ptable->ucRevId < 1) {
 		const ATOM_Tonga_PCIE_Table *atom_pcie_table = (ATOM_Tonga_PCIE_Table *)ptable;
@@ -741,6 +750,16 @@
 	pp_gpio_table = kzalloc(table_size, GFP_KERNEL);
 	if (!pp_gpio_table)
 		return -ENOMEM;
+
+	/*
+	 * DF-1575: same NULL guard as get_pcie_table -- vdd_dep_on_sclk may
+	 * never have been allocated if usSclkDependencyTableOffset==0, but
+	 * get_gpio_table is reached whenever gpio_table is non-NULL.
+	 */
+	if (!pp_table_information->vdd_dep_on_sclk) {
+		kfree(pp_gpio_table);
+		return -EINVAL;
+	}
 
 	if (pp_table_information->vdd_dep_on_sclk->count <
 			atom_gpio_table->ucVRHotTriggeredSclkDpmIndex)