== DF-3754 harness: ni_dpm boot_ps/ps_priv NULL deref ==
offsetof(struct radeon_ps, ps_priv) = 0x28 (kernel: 0x28, LP64)

[shape 3] 3 states, none ATOM_PPLIB_CLASSIFICATION_BOOT:
    ni_parse_power_table rc=0, num_ps=3, boot_ps=0x0

[A] Buggy path: ni_dpm_enable -> ni_init_smc_table ->
    ni_populate_smc_initial_state(NULL) -> ni_get_ps(NULL)->ps_priv
    child died from signal 11: read at NULL+0x28
    >>> kernel: page-fault at 0x28 -> panic during DPM enable <<<

[shape 2] ucStateEntrySize==1: rc=0, num_ps=2, boot_ps=0x0,
    ps[0].ps_priv=0x0 ps[1].ps_priv=0x0 (never assigned)
    (a BOOT-classified non-clock entry exists but is never parsed:
    the whole block is skipped, so boot_ps is NULL too)

[A2] Buggy path: ni_dpm_pre_set_power_state ->
     ni_update_requested_ps -> `*new_ps` with new_ps==NULL
     child died from signal 11: read at NULL+0x0
     >>> kernel: page-fault at 0 -> panic on first state change <<<

[B] Fixed path (fix.diff: ni_dpm_enable guard `if (boot_ps == NULL) return -EINVAL;`)
    rc=-EINVAL (DPM enable refused, no dereference)