# DF-4291 — `atomctrl_get_voltage_evv()` dereferences `hwmgr->dyn_state.vddc_dependency_on_sclk` without a NULL check

Pass-2 finding for `sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c`
(the "(e) powerplay table glue — the hwmgr dyn_state field fills" item of
the pass-2 brief). Not DF-1497 (that is the svi2 lookup NULL deref in this
same file) — this is the **dyn_state table pointer** NULL deref.

## The bug (ppatomctrl.c:1131, 1138, 1147)

```c
int atomctrl_get_voltage_evv(struct pp_hwmgr *hwmgr, ...)
{
        ...
        for (entry_id = 0;
             entry_id < hwmgr->dyn_state.vddc_dependency_on_sclk->count;   /* :1131 */
             entry_id++) {
                if (hwmgr->dyn_state.vddc_dependency_on_sclk
                        ->entries[entry_id].v == virtual_voltage_id) {     /* :1132 */
```

`hwmgr->dyn_state.vddc_dependency_on_sclk` is initialized to **NULL** by
the powerplay-table parser (`processpptables.c:1213`) and only filled when
the VBIOS powerplay table v4+ carries a non-zero
`usVddcDependencyOnSCLKOffset` (`processpptables.c:1304-1310`). The parser
itself treats the field as nullable (`processpptables.c:1341-1342`:
`if (result == 0 && (NULL != hwmgr->dyn_state.vddc_dependency_on_sclk) && ...)`),
but `atomctrl_get_voltage_evv` does not.

Reachability: `phm_get_voltage_evv_on_sclk()` dispatches here for
`chip_id < CHIP_TONGA` (smu_helper.c:571-572); its only caller is
`smu7_get_evv_voltages()` (smu7_hwmgr.c:1760), invoked from
`smu7_hwmgr_backend_init()` (smu7_hwmgr.c:2551) at driver attach — reached
whenever the powerplay table is V0 or the lookup path fails
(smu7_hwmgr.c:1742). A CI/KV-class card whose VBIOS powerplay table omits
the VDDC-on-SCLK dependency sub-table ⇒ `NULL->count` ⇒ `Fatal trap 12`
kernel panic at attach/boot (CWE-476).

## Reproduce

Not runnable on this guest (no AMD dGPU — env.txt). On hardware: VBIOS
powerplay table with `usVddcDependencyOnSCLKOffset == 0` on a pre-Tonga
(CI/KV) part, boot → panic at amdgpu attach.