# DF-4040 VERDICT — polaris10 VCE/UVD/CAC level population NULL-derefs when the PowerPlay table omits the MM-dependency or VDDC-lookup subtable offsets

## Bottom line

Source-certain NULL derefs, fiji DF-4006 / DF-3685 family on polaris: the V1 parser treats usMMDependencyTableOffset and usVddcLookupTableOffset as optional (mm table left NULL at process_pptables_v1_0.c:794-802, lookup at :281-288; parse result stays 0), but polaris10_init_smc_table unconditionally calls polaris10_populate_smc_vce_level (mm_table->count at polaris10_smumgr.c:1298), polaris10_populate_smc_uvd_level (:1404) and polaris10_populate_smc_voltage_tables -> polaris10_populate_cac_table (lookup_table->count at :712). Each faults on the NULL page during driver attach/resume -> kernel panic. Demonstrated (child SIGSEGV on the NULL deref): run.log DF-4040. Hardware-gated -> runtime inconclusive, source certain.

## Exploit chain

crafted vBIOS PowerPlay table with usMMDependencyTableOffset==0 (or usVddcLookupTableOffset==0) -> parse OK -> polaris10_init_smc_table -> populate_* -> NULL->count page fault => panic

## Why not reproduced on the guest

The audit guest is QEMU/KVM with virtio display only: no AMD GPU, /dev/dri absent (env.txt), so polaris10_powerplay never binds — the crafted-VBIOS trigger cannot be exercised at runtime. The index arithmetic and struct geometry are proven against the kernel headers compiled verbatim (run.log), and the fix is compile-validated (fix_build.log).

## Negative results recorded alongside (pass-2 depth)

Checklist item kills: LinkLevel i<=count walk is bounded (pcie count clamped to <=7 at smu7_hwmgr.c:561-569); mc_reg-table walks are not in this file (smu7_smumgr.c owns them); fan-table div0 is known DF-1345; VCE/UVD count overflow is known DF-1346; Smio[32] and SmioTable.Pattern[4] walks are correctly clamped (SMU_MAX_SMIO_LEVELS).

## Fix

NULL-check mm_table in the VCE/UVD populators (return -EINVAL) and lookup_table in the CAC populator (fix.diff). Applied and compile-validated on the guest (fix_build.log); sys/ tree never modified by the audit.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.