# DF-4292 — `atomctrl_get_smc_sclk_range_table()` dereferences the SMU_Info table pointer without a NULL check

Pass-2 finding for `sys/dev/drm/amd/powerplay/hwmgr/ppatomctrl.c`.
Distinct from DF-1496 (which is the unbounded `ucSclkEntryNum` **count
overflow** in this same function): DF-4292 is the missing **NULL check on
the table pointer itself** — a VBIOS that omits the SMU_Info data table
panics before the count is even read.

## The bug (ppatomctrl.c:1368-1374)

```c
ATOM_SMU_INFO_V2_1 *psmu_info =
        (ATOM_SMU_INFO_V2_1 *)smu_atom_get_data_table(hwmgr->adev,
                GetIndexIntoMasterTable(DATA, SMU_Info), &size, &frev, &crev);

for (i = 0; i < psmu_info->ucSclkEntryNum; i++) {      /* NULL deref */
```

`smu_atom_get_data_table()` (smu_helper.c:660-673) returns NULL when the
VBIOS master data table has no SMU_Info entry; `amdgpu_atom_parse_data_header`
(amdgpu/atom.c:1384-1403) validates nothing. Callers
(`vegam_smumgr.c:677`, `polaris10_smumgr.c:807`) invoke this during SMU
backend init at driver attach:

```c
if (0 == atomctrl_get_smc_sclk_range_table(hwmgr, &range_table_from_vbios)) {
```

A VEGAM/Polaris VBIOS without an SMU_Info table ⇒ `NULL->ucSclkEntryNum`
⇒ `Fatal trap 12` kernel panic at boot/module-load (CWE-476).

Every sibling getter in this file NULL-checks its data table
(`atomctrl_get_reference_clock` :494, `asic_internal_ss_get_ss_table`
via :1228, `atomctrl_calculate_voltage_evv_on_sclk` :682,
`atomctrl_get_leakage_vddc_base_on_leakage` :1492,
`atomctrl_get_avfs_information` :1400); this one and
`atomctrl_initialize_mc_reg_table` (DF-4288) are the exceptions.

## Reproduce

Not runnable on this guest (no AMD dGPU — env.txt). On hardware: VEGAM or
Polaris10/11 dGPU whose VBIOS master data table lacks SMU_Info; kldload
amdgpu → panic in atomctrl_get_smc_sclk_range_table at attach.