{
  "finding_id": "DF-4074",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Source-level certain, hardware-gated NULL-deref panic. The V1 pptable parser leaves table_info->mm_dep_table == NULL when usMMDependencyTableOffset == 0 (process_pptables_v1_0.c:796-802). vegam dereferences it unconditionally: vegam_update_uvd_smc_table():340 table_info->mm_dep_table->count (reached via vegam_update_smc_table(SMU_UVD_TABLE) whenever UVD DPM is enabled) and vegam_update_vce_smc_table():374 under PHM_PlatformCaps_StablePState. NULL kernel deref => panic/DoS on first UVD (video) use with such a table. The NULL aspect at :1217/:1330 rides the same optional-table root but those functions count walks are DF-1366/DF-1367 (not re-reported). The vddc_lookup_table NULL deref at :515 sits inside DF-1368s function (excluded).",
  "exploit_chain": "",
  "evidence": "process_pptables_v1_0.c:796 pp_table_information->mm_dep_table = NULL + :800 conditional init; vegam_smumgr.c:340 and :374 unconditional deref",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:340",
    "sys/dev/drm/amd/powerplay/smumgr/vegam_smumgr.c:374",
    "sys/dev/drm/amd/powerplay/hwmgr/process_pptables_v1_0.c:796"
  ],
  "poc_changes": "n/a (source-level)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a (source-level finding)",
  "run_cmd": "n/a (hardware-gated; source-level analysis)",
  "code_hash": null,
  "notes": "smu7-side sibling of the DF-3685 family but at vegams own sites; panic only (no memory corruption).",
  "recommended_fix": "NULL-guard mm_dep_table in both update_*_smc_table() helpers (return 0 with a dev_info, as the polaris fix did).",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Hardware-gated finding (no AMD VegaM GPU / no LSI mps controller on the audit guest): fix authored at source level (fix.diff) but not build/boot-validated.",
  "fix_evidence": "fix.diff in this pack; authored post-analysis, not hardware-validated."
}