# DF-2319 -- NULL pointer dereference in CISTPL_CFTABLE_ENTRY handler when no CISTPL_CONFIG precedes it

File: sys/bus/pccard/pccard_cis.c (verify pass, GLM 5.3).  Full narrative: VERDICT.md.

## Reproduce (verbatim production parser, guest toolchain, no PCMCIA HW needed)
    ./build.sh          # sh extract.sh .  &&  cc -O2 -Wall -o rig rig_main.c
    ./run.sh            # baseline scenarios: ./rig nullderef_a && ./rig nullderef_b
    sh run_matrix.sh    # A/B: baseline vs each single-fix variant, all scenarios

Expected decisive output (DF-2319): BASELINE (pristine parser): nullderef_a -> SIGSEGV si_addr=0x0, child_exit=91; nullderef_b -> SIGSEGV si_addr=0x30, child_exit=91. WITH fix.diff (f2319 variant): both return normally, card->error=1, child_exit=0; all other scenarios (incl. benign valid card) unchanged.

## What it proves
The rig executes the **byte-identical production parser** extracted from the
guest's /usr/src (sha256-gated; extract_manifest.txt) through the real entry
`pccard_read_cis()`. Kernel entry is hardware-gated (no PCMCIA bridge in
QEMU) -- see VERDICT.md for the method, the A/B matrix, and the
booted-combined-fix-kernel validation.

Recommended fix: Guard the CFTABLE_ENTRY case: require state->default_cfe and state->pf non-NULL (error++ + break otherwise). (fix.diff; validated, see fixed_run.log /
matrix.log / postboot_run.log).