# DF-3685 — NULL-subtable dereference family at smu7 backend init: V1 parser treats dependency/lookup/PowerTune subtables as optional, smu7 derefs them unconditionally

**File:** `sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c` (pass 2, GLM 5.3 re-audit)
**Severity:** Medium | **CVSS:** CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | **CWE:** CWE-476 NULL Pointer Dereference | **Confidence:** certain (source)

## What this is

Source-certain NULL-deref family; runtime-inconclusive on this guest (no AMD GPU). The V1 parser only fills mm_dep_table / vddc+vddgfx_lookup_table / cac_dtp_table / vdd_dep_on_sclk / vdd_dep_on_mclk when the matching VBIOS PP-table offset is non-zero and still returns success when they are absent (process_pptables_v1_0.c:794-845, :281-297, :800-806). smu7_hwmgr_backend_init (:2560-2566) then ignores the return codes of smu7_complete_dependency_tables() and smu7_set_private_data_based_on_pptable_v1() and limps on: smu7_patch_voltage_dependency_tables_with_lookup_table derefs mm_table->count (:1878) and vddc/vddgfx_lookup_table->entries[] (:1862/:1868/:1875/:1881); smu7_patch_lookup_table_with_leakage derefs lookup_table->count (:1823) via :2027-2037; smu7_thermal_parameter_init derefs cac_dtp_table (:2183); smu7_get_thermal_temperature_range derefs cac_dtp_table on sysfs temp read (:4764); smu7_init_dpm_defaults derefs cac_dtp_table under the PP_CLOCK_STRETCH feature bit (:1664-1665). A crafted VBIOS zeroing those offsets panics the kernel at driver load (or on first temperature-range sysfs read). Note: a NULL vdd_dep_on_sclk alone already faults earlier inside the parser itself - that specific instance is DF-1575 (process_pptables_v1_0.c); this finding covers the subtables the parser does NOT touch. Harness reproduces the parse-legal NULL chain and flags the five reachable deref sites.

## Reproduce (harness on the audit QEMU guest)

```
scp -F dfbsd-qemu/config null_subtable_deref.c dfbsd-maxx:/tmp/DF-3685/
ssh -F dfbsd-qemu/config dfbsd-maxx 'cd /tmp/DF-3685 && cc -Wall -O0 -o t null_subtable_deref.c && ./t'
```

Expected: the run prints the confirmed-primitive line (`RESULT: ... CONFIRMED ...`).
See `run.log` (and `run.2.log` where present) for the decisive captured output,
`build.log` for the guest toolchain transcript, `env.txt` for the guest environment
(virtio-only, **no AMD GPU** — `pciconf -l` shows only 0x1237/0x1111 QEMU devices;
`drm.ko`/`amdgpu.ko` exist in /boot/kernel but are not loaded and have no hardware
to bind), which is why the in-kernel trigger itself is inconclusive on this guest.

## Fix

`fix.diff` (authored against the read-only sys/ tree; never applied there).