# DF-3623 VERDICT — unvalidated boot_ps NULL dereference

## Bottom line

**Real bug, source-certain; runtime inconclusive (no AMD GPU on guest).**

`adev->pm.dpm.boot_ps` is only ever assigned in
`ci_parse_pplib_non_clock_info()` (ci_dpm.c:5573-5574) and only when the
VBIOS power table contains a state classified
`ATOM_PPLIB_CLASSIFICATION_BOOT`. A crafted (or simply malformed) VBIOS
without such a state leaves `boot_ps == NULL`; nothing between the parser
and the consumer checks it:

- `ci_dpm_enable()` ci_dpm.c:5297 — `boot_ps = adev->pm.dpm.boot_ps;` (NULL)
- `ci_init_smc_table()` ci_dpm.c:3704 — `amdgpu_boot_state = boot_ps;` then
  ci_dpm.c:3786 `ci_populate_smc_initial_state(adev, amdgpu_boot_state)`
- first dereference: `ci_get_ps()` ci_dpm.c:326-331 executes
  `rps->ps_priv` on the NULL pointer; the second,
  `boot_state->performance_levels[0].sclk` at ci_dpm.c:2731 (and .mclk at
  :2739)
- the tail of a successful enable would additionally deref NULL in
  `ci_update_current_ps(adev, boot_ps)` (ci_dpm.c:5412 → 5245-5248: `*rps`
  copies). `ci_dpm_disable()` has the same unguarded `boot_ps`
  (ci_dpm.c:5420/5450).

NULL-page dereference in the device-init kernel thread → panic at driver
bind (and at each resume, since `ci_dpm_resume` → `ci_dpm_enable`).

## Verification narrative

- Guest lacks any AMD ASIC → the kernel path cannot execute →
  **inconclusive**; module presence verified.
- `ci_bootps_null.c` executed on the guest walks the exact call chain with
  a BOOT-less classification and traps SIGSEGV at `NULL+offsetof(ps_priv)`
  (run.log) — the userspace image of the kernel NULL-page fault.
- Same defect class and fix as the si_dpm twins DF-3586 / DF-3610
  (upstream radeon fixed this class by failing init when boot_ps is NULL).

## Fix

`fix.diff` fails `ci_dpm_init()` with `-EINVAL` right after
`ci_parse_power_table()` when no BOOT state was found, preventing the
later dereferences. Not testable on this guest.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.