{
  "finding_id": "DF-4291",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "atomctrl_get_voltage_evv() (ppatomctrl.c:1121-1160) dereferences hwmgr->dyn_state.vddc_dependency_on_sclk->count at :1131 (and :1132/:1138/:1147) with no NULL check. The powerplay-table parser initializes the pointer to NULL (processpptables.c:1213) and only fills it when the VBIOS powerplay table v4+ has a non-zero usVddcDependencyOnSCLKOffset (processpptables.c:1304-1310); the parser itself NULL-guards the same field at processpptables.c:1341-1342, establishing that NULL is an expected state. Dispatch: smu7_hwmgr_backend_init (smu7_hwmgr.c:2551) -> smu7_get_evv_voltages (:1760) -> phm_get_voltage_evv_on_sclk (smu_helper.c:571-572, chip_id < CHIP_TONGA) -> this function; a CI/KV-class VBIOS omitting the VDDC-on-SCLK sub-table yields Fatal trap 12 NULL-deref kernel panic at driver attach (CWE-476). Crafted-VBIOS threat model, Medium (DF-1497 band). Not runnable on this guest (no AMD dGPU \u2014 env.txt); trace-certain.",
  "exploit_chain": "",
  "evidence": "VERDICT.md (parser-contract + dispatch trace); README.md; fix.diff (NULL guard); env.txt",
  "kernel_refs": [
    "sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c:1131",
    "sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:1213",
    "sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:1304",
    "sys/dev/drm/amd/powerplay/hwmgr/processpptables.c:1341",
    "sys/dev/drm/amd/powerplay/hwmgr/smu7_hwmgr.c:1760",
    "sys/dev/drm/amd/powerplay/hwmgr/smu_helper.c:571"
  ],
  "poc_changes": "n/a \u2014 no AMD dGPU on guest; code-trace evidence pack",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "notes": "Hardware-absent case (DF-1497/1498 precedent). Pre-Tonga (CI/KV) only; smu7 covers those chips in this tree.",
  "recommended_fix": "NULL-check hwmgr->dyn_state.vddc_dependency_on_sclk at the top of atomctrl_get_voltage_evv and return -EINVAL",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Baseline behavior not reproducible on this guest (no AMD dGPU) -> no fixed-kernel build possible. fix.diff authored from trace.",
  "fix_evidence": "findings/poc/DF-4291/fix.diff (not applied to sys/; authored post-verification from line-accurate trace)"
}