{
  "finding_id": "DF-3685",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-certain NULL-deref family; runtime-inconclusive on this guest (no AMD GPU). The V1 parser only fills mm_dep_table / vddc+vddgfx_lookup_table / cac_dtp_table / vdd_dep_on_sclk / vdd_dep_on_mclk when the matching VBIOS PP-table offset is non-zero and still returns success when they are absent (process_pptables_v1_0.c:794-845, :281-297, :800-806). smu7_hwmgr_backend_init (:2560-2566) then ignores the return codes of smu7_complete_dependency_tables() and smu7_set_private_data_based_on_pptable_v1() and limps on: smu7_patch_voltage_dependency_tables_with_lookup_table derefs mm_table->count (:1878) and vddc/vddgfx_lookup_table->entries[] (:1862/:1868/:1875/:1881); smu7_patch_lookup_table_with_leakage derefs lookup_table->count (:1823) via :2027-2037; smu7_thermal_parameter_init derefs cac_dtp_table (:2183); smu7_get_thermal_temperature_range derefs cac_dtp_table on sysfs temp read (:4764); smu7_init_dpm_defaults derefs cac_dtp_table under the PP_CLOCK_STRETCH feature bit (:1664-1665). A crafted VBIOS zeroing those offsets panics the kernel at driver load (or on first temperature-range sysfs read). Note: a NULL vdd_dep_on_sclk alone already faults earlier inside the parser itself - that specific instance is DF-1575 (process_pptables_v1_0.c); this finding covers the subtables the parser does NOT touch. Harness reproduces the parse-legal NULL chain and flags the five reachable deref sites.",
  "exploit_chain": "",
  "evidence": "run.log: pp_tables_v1_0_initialize returned 0 (parse SUCCEEDS) followed by five NULL DEREF at smu7_hwmgr.c:... site listings; VERDICT.md; fix.diff (NULL guards + error propagation at :2560-2566)",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:1878",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:1823",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:2560",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:2183",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:4764",
    "sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:794",
    "sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:281"
  ],
  "poc_changes": "No seed; wrote a control-flow harness emulating the parsers offset==0 -> NULL -> rc=0 behaviour and walking the smu7 deref chain (no fault executed).",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 90,
  "guest_dirty": 0,
  "build_cmd": "cc -Wall -O0 -o t null_subtable_deref.c (DragonFly 6.5 base cc, on guest)",
  "run_cmd": "cd /tmp/DF-3685 && ./t",
  "code_hash": "d910f029504f36e8608bed5d9d18a1d2ccd158389a43bd84532ea8a216c4076d",
  "notes": "Guest virtio-only (no AMD GPU: pciconf shows only QEMU 0x1237/0x1111; amdgpu.ko/drm.ko present in /boot/kernel but unloaded). Harness proves the primitive/arithmetic with verbatim kernel code shape and 1:1 struct layouts; the in-kernel trigger needs an SMU7 ASIC + crafted VBIOS / VFIO / root pp_table write. Compiled -O0: -O2 detects the index UB and misoptimizes the accounting.",
  "recommended_fix": "Validate the mandatory V1 subtables in smu7_complete_dependency_tables (return -EINVAL on NULL mm/lookup/cac tables), propagate the error out of smu7_hwmgr_backend_init instead of ignoring it, and NULL-guard cac_dtp_table at :2183/:4764/:1665.",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored against the read-only sys/ tree after source+harness verification; not built (no AMD hardware on guest).",
  "fix_evidence": "findings/poc/DF-3685/fix.diff"
}