# DF-4169 — smu8 power-state casts unchecked: NULL deref when VBIOS has no Boot-classified state

- File: sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c
  primary site: smu8_apply_state_adjust_rules :1041-1045 cast → :1051 NULL+0x30 WRITE, :1066 NULL+0x40 read
  sibling sites: smu8_dpm_get_sclk :1316-1321 (NULL+0x4/0x44; levels[0xFFFFFFFF] when level==0),
                 smu8_get_current_shallow_sleep_clocks :1598-1601 (levels[0xFFFFFFFF]),
                 smu8_get_performance_level :1569-1572 (clamp defeat → unclamped levels[index])
- Window creator: sys/dev/drm/amd/powerplay/hwmgr/pp_psm.c psm_init_power_state_table
  (kzalloc'd request_ps/current_ps only receive the smu8 magic via memcpy of a
  Boot-classified state; no Boot state in the VBIOS powerplay table => magic stays 0)
- Class: NULL pointer dereference + level==0 index underflow, CWE-476/CWE-125.
  Hardware-gated (Carrizo/Bristol Ridge SMU8 APU, crafted VBIOS powerplay table).
  DF-4143 family twin for smu8.

## Verification (2026-10-15, verbatim-rig evidence class)

REPRODUCED in byte-identical production code on the DragonFly guest
(no AMD GPU — the in-kernel path is ASIC-gated; see VERDICT.md §1):

    cd rig && sh build.sh /usr/src    # 26 verbatim blocks checker-proven, builds rig_base + rig_fixed
    sh run.sh                         # baseline + fixed (this pack's fix.diff) over 11 modes

Expected (see run.log):

- baseline `4169-*` modes: SIGSEGV classified — WRITE at NULL+0x30
  (smu8_apply_state_adjust_rules :1051), READ at NULL+0x4 / NULL+0x44
  (smu8_dpm_get_sclk), ~64 GB wild reads (levels[0xFFFFFFFF], :1321/:1601),
  OOB read 324 B past the 320 B state allocation
  (smu8_get_performance_level clamp defeat, :1571-1572);
- baseline `4169-boot-chain-control`: no fault (Boot flag present ⇒ magic
  stamped) — isolates the precondition;
- fixed build: all `4169-*` modes return -EINVAL, no fault;
  `clean-valid` output byte-identical to baseline;
  `4171-*` modes still fault under this fix (orthogonal finding DF-4171).

Logs: build.log, run.log, run.2.log, run.3.log (three byte-identical runs).
Full narrative: VERDICT.md. fix.diff authored against the read-only sys/
tree, A/B validated in the rig, never applied to sys/.