--- /home/maxx/dfbsd/dfbsd/sys/dev/drm/amd/powerplay/hwmgr/smu8_hwmgr.c	2026-06-29 12:51:18.000000000 +0000
+++ s8_fix4169.c	2026-09-18 09:49:04.516579544 +0000
@@ -454,6 +454,12 @@
 	if (!hwmgr->need_pp_table_upload)
 		return 0;
 
+	if (!vddc_table || !vdd_gfx_table || !acp_table || !uvd_table ||
+	    !vce_table) {
+		pr_err("smu8: missing clock/voltage dependency table(s) in VBIOS powerplay table!\n");
+		return -EINVAL;
+	}
+
 	ret = smum_download_powerplay_table(hwmgr, &table);
 
 	PP_ASSERT_WITH_CODE((0 == ret && NULL != table),
@@ -1048,6 +1054,14 @@
 	struct PP_Clocks clocks = {0, 0, 0, 0};
 	bool force_high;
 
+	/* The casts return NULL when the state was never initialized with our
+	 * magic (e.g. the VBIOS power table has no Boot-classified state, so
+	 * hwmgr->request_ps/current_ps stayed zeroed) - bail out instead of
+	 * dereferencing NULL.
+	 */
+	if (smu8_ps == NULL || smu8_current_ps == NULL)
+		return -EINVAL;
+
 	smu8_ps->need_dfs_bypass = true;
 
 	data->battery_state = (PP_StateUILabel_Battery == prequest_ps->classification.ui_label);
@@ -1315,6 +1329,9 @@
 
 	smu8_ps = cast_smu8_power_state(&ps->hardware);
 
+	if (smu8_ps == NULL || smu8_ps->level == 0)
+		return -EINVAL;
+
 	if (low)
 		return smu8_ps->levels[0].engineClock;
 	else
@@ -1568,6 +1585,9 @@
 	data = hwmgr->backend;
 	ps = cast_const_smu8_power_state(state);
 
+	if (ps == NULL || ps->level == 0)
+		return -EINVAL;
+
 	level_index = index > ps->level - 1 ? ps->level - 1 : index;
 	level->coreClock = ps->levels[level_index].engineClock;
 
@@ -1597,6 +1617,9 @@
 {
 	const struct smu8_power_state *ps = cast_const_smu8_power_state(state);
 
+	if (ps == NULL || ps->level == 0)
+		return -EINVAL;
+
 	clock_info->min_eng_clk = ps->levels[0].engineClock / (1 << (ps->levels[0].ssDividerIndex));
 	clock_info->max_eng_clk = ps->levels[ps->level - 1].engineClock / (1 << (ps->levels[ps->level - 1].ssDividerIndex));