# VERDICT — DF-4006

**Status: inconclusive at runtime (hardware-gated); source-certain.**

Demonstrated (run.log, section DF-4006): a NULL `mm_dep_table` deref faults
(child took signal 11 on `mm_table->count`). Source chain:
`process_pptables_v1_0.c:794-802` initializes `pp_table_information->mm_dep_table = NULL`
and populates it only `if (powerplay_table->usMMDependencyTableOffset != 0)`
without failing the parse; `smu7_hwmgr` never touches mm_dep_table, so the NULL
survives to `fiji_init_smc_table` → `fiji_populate_smc_vce_level:1433`
(`table->VceLevelCount = (uint8_t)(mm_table->count)`), and equivalently
`:1472` (ACP) / `:1569` (UVD) / `:2374` / `:2407` (update paths). Result: page
fault during pp_hwmgr init (attach/resume) from a crafted vBIOS with a zero
MMDependencyTable offset — kernel panic; DF-1419/DF-1550/DF-1610 family.
Privileged/physical context → Low.

Fix: `fix.diff` adds NULL checks (+ the DF-4002 clamps) in the three populate
functions; nativekernel rebuild OK (fix_build.log), reverted.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.