# DF-3651 — NULL-pointer dereference of rdev->pm.dpm.dyn_state.cac_tdp_table when the VBIOS has no PowerTune table: five unchecked sinks in ci_dpm.c

File: `sys/dev/drm/radeon/ci_dpm.c` (pass 2, GLM 5.3 re-audit)
Severity: Medium  |  CWE-476 NULL Pointer Dereference  |  confidence: certain

## Reproduce
No harness: the defect is a NULL/UAF control-flow property (source-level certainty);
the kernel path needs CI-class hardware absent from the guest — see env.txt.

    (source review only; see VERDICT.md)

Full narrative: VERDICT.md. Proposed fix: fix.diff (authored against the read-only
sys/ tree; never applied there).