# DF-3702 — vega10 backend-init dereferences optional pptable subtables without NULL checks (missing-offset VBIOS => NULL-deref panic)

File: sys/dev/drm/amd/powerplay/hwmgr/vega10_hwmgr.c (pass 2). smu7 checklist item (c) — DF-3685 vega10 twin.

## Root cause
`vega10_pp_tables_initialize` (vega10_processpptables.c:905-922, verified in guest src) initializes
every subtable pointer to NULL and only parses a subtable when its offset field in the ATOM
powerplay table is non-zero; a zero offset leaves the pointer NULL **and result == 0 (success)**.
Later, `vega10_hwmgr_backend_init` dereferences those pointers unconditionally, BEFORE the only
NULL asserts in the path (`vega10_set_private_data_based_on_pptable` :754-762 runs at :879):

1. `vega10_set_features_platform_caps` :269 — `table_info->tdp_table->usClockStretchAmount`
   (called from backend_init :862). tdp_table is NULL when `usPowerTuneTableOffset == 0`.
2. `vega10_complete_dependency_tables` (backend_init :876) →
   `vega10_patch_voltage_dependency_tables_with_lookup_table` :635-686:
   - :658 `vdt->count` / :659 `vdt->entries[entry_id]` for all six dep tables
     (socclk/gfxclk/dcefclk/pixclk/dispclk/phyclk) — any NULL offset => deref,
   - :661 `table_info->vddc_lookup_table->entries[...]` — NULL when usVddcLookupTableOffset == 0,
   - :665 `mm_table->count` — NULL when usMMDependencyTableOffset == 0,
   - :677 `vddci_lookup_table->entries[...]`, :680 `vddmem_lookup_table->entries[...]`
     — NULL when the respective offsets are 0 (loop over mclk entries runs unconditionally).

## Trigger (requires AMD Vega10 hardware)
Craft VBIOS powerplay table: zero one or more of usPowerTuneTableOffset / us*DependencyTableOffset /
usVddcLookupTableOffset / usVddciLookupTableOffset / usVddmemLookupTableOffset / usMMDependencyTableOffset
(keep VDDC SVID2 atomfirmware objects intact so backend_init reaches :862). Driver attach
→ immediate NULL-deref kernel panic (DoS at boot/hotplug).

## PoC status
Guest virtio-only (env.txt) — amdgpu never binds; status inconclusive, source-certain.