# DF-4074 VERDICT — source-level certain, hardware-gated

## Root cause
- The V1 pptable parser leaves `pp_table_information->mm_dep_table = NULL` whenever
  usMMDependencyTableOffset == 0 (process_pptables_v1_0.c:796-802) — a perfectly parseable,
  well-formed-but-minimal VBIOS powerplay table.
- vegam dereferences it with no NULL check:
    vegam_smumgr.c:340  `if (table_info->mm_dep_table->count > 0)` — vegam_update_uvd_smc_table()
    vegam_smumgr.c:374  `smc_state_table.VceBootLevel = (uint8_t)(table_info->mm_dep_table->count - 1)`
                        (StablePState path) — vegam_update_vce_smc_table()
- Reachability: vegam_update_smc_table() dispatches SMU_UVD_TABLE / SMU_VCE_TABLE to these helpers;
  the smu7 hwmgr invokes them when UVD/VCE DPM is enabled (video encode/decode use).
- NULL kernel deref ⇒ panic (local DoS with such a VBIOS; also count-1 underflow at :374 if a table
  exists with count==0, but the parser asserts ucNumEntries != 0 — NULL is the realistic path).

## Scope discipline
- :1217 / :1330 (populate vce/uvd level) also deref mm_table, but those FUNCTIONS are DF-1366/67 —
  only their NULL aspect shares this root; not re-filed.
- vddc_lookup_table NULL at :515 is inside DF-1368's function — excluded.

## Fix
NULL-guard in both helpers (return 0 with a dev_info, matching the polaris-family fix pattern).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.