# DF-3646 — NULL-pointer dereference of rdev->pm.dpm.boot_ps when the VBIOS power table has no ATOM_PPLIB_CLASSIFICATION_BOOT state

File: `sys/dev/drm/radeon/ci_dpm.c` (pass 2, GLM 5.3 re-audit)
Severity: Medium  |  CWE-476 NULL Pointer Dereference  |  confidence: certain

## Reproduce
No harness: the defect is a NULL/UAF control-flow property (source-level certainty);
the kernel path needs CI-class hardware absent from the guest — see env.txt.

    (source review only; see VERDICT.md)

Full narrative: VERDICT.md. Proposed fix: fix.diff (authored against the read-only
sys/ tree; never applied there).