# DF-3942 — bios_parser.c: five SS-table parsers dereference unchecked GET_IMAGE() results (NULL-deref panic)

**File:** `sys/dev/drm/amd/display/dc/bios/bios_parser.c` (pass 2)
**Severity:** Low · **Confidence:** certain (source level) · **Hardware-gated** (needs an AMD GPU + crafted/corrupt VBIOS)

## Build

```
cc -O2 -Wall -o /tmp/bios_ss_null_deref_replica bios_ss_null_deref_replica.c
```

## Run

```
/tmp/bios_ss_null_deref_replica
```

## Expected

This is a **userland logic replica** of the exact kernel decision path
(same `bios_get_image()` bounds semantics, same probe order). It prints the
kernel-side trace (4-byte revision probe succeeds at a table offset 10 bytes
from the image end; full-struct GET_IMAGE returns NULL) and then executes
the replicated deref → SIGSEGV (rc=139), demonstrating the NULL is reached.
In the kernel the same load faults the NULL page → panic during
amdgpu/dc attach. See run.log.

The in-kernel path cannot run on the audit guest: there is no AMD/ATI PCI
device and no amdgpu module (verified, env.txt).

## Contents

* `bios_ss_null_deref_replica.c` — logic replica of bios_parser.c:1028-1048
* `build.sh` / `run.sh`, `build.log` / `run.log` — untrimmed
* `fix.diff` — five NULL guards, git-apply-able, **compile-validated** by a
  full amdgpu.ko rebuild on the guest kernel tree (fix_build.log, -Werror, rc=0)
* `VERDICT.md`, `manifest.json`, `verdict.json`