# DF-3702 VERDICT — NULL subtable derefs at backend init

**status: inconclusive (hardware-gated) — source-certain. reproduced=0 on audit guest.**

## Proof chain (all lines verified byte-identical in guest /usr/src, see run.log)
1. Parser: vega10_processpptables.c:905-913 sets all 9 subtable pointers NULL;
   :916-922 (and the following identical guards for socclk/gfxclk/pix/phy/disp/dcef/mclk,
   pcie, hardlimit, and :1107-1128 for the three lookup tables) only populate a pointer
   when `powerplay_table->us<Table>Offset != 0`; offsets of 0 do NOT fail the parse.
2. `hwmgr_hw_init` (hwmgr.c:222-229) calls pptable_init first, then backend_init.
3. `vega10_hwmgr_backend_init`:
   - :862 `vega10_set_features_platform_caps` → :269 `table_info->tdp_table->usClockStretchAmount`
     — NULL tdp_table (usPowerTuneTableOffset==0) → NULL+offset deref → panic.
   - :876 `vega10_complete_dependency_tables` → :734
     `vega10_patch_voltage_dependency_tables_with_lookup_table` → :658 `vdt->count` for each of
     the 6 dep tables, :661 vddc_lookup_table, :665 mm_table, :677/:680 vddci/vddmem lookups —
     any of them NULL → panic. This runs BEFORE :879 `vega10_set_private_data_based_on_pptable`,
     whose :754-762 asserts are the only NULL checks in the whole path (and even they only
     cover vdd_dep_on_socclk and vdd_dep_on_mclk).
4. Contrast: the smu10/vega12 families and the later upstream vega10 code add explicit
   `PP_ASSERT_WITH_CODE(table_info->x, ...)` guards; this file has none for tdp/mm/lookup
   and relies on deref order.

Impact: crafted-VBIOS (flash / malicious eGPU / VFIO passthrough) → deterministic
kernel NULL-deref panic during amdgpu attach → local DoS (boot-time or hotplug).
Not memory corruption beyond the fault; severity Medium.

## Guest result
0 AMD PCI devices; amdgpu.ko present but never binds; the panic cannot be produced on
this guest. Cited lines confirmed present in guest /usr/src (run.log). Honest verdict:
inconclusive (hardware-gated), source-certain.

## Fix
fix.diff adds NULL guards (assert+skip / assert+return -EINVAL) at :269 and in the
patch loop for each table, mirroring the set_private_data asserts.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.