# DF-4292 VERDICT — psmu_info NULL deref

## Status: inconclusive (code-trace certain; guest has no AMD dGPU)

## Trace

* ppatomctrl.c:1368-1371 — `psmu_info = smu_atom_get_data_table(...,
  GetIndexIntoMasterTable(DATA, SMU_Info), ...)`.
* ppatomctrl.c:1374 — `for (i = 0; i < psmu_info->ucSclkEntryNum; i++)`
  first deref; no NULL check in the function (ppatomctrl.c:1361-1386).
* smu_helper.c:660-673 — helper returns NULL on lookup failure;
  amdgpu/atom.c:1384-1403 — atom header parser performs no validation,
  so "table absent from master data table" is fully attacker-shaped.
* Callers (no pre-check): vegam_smumgr.c:677, polaris10_smumgr.c:807 —
  both inside SMU backend init at driver attach.
* Sibling getters in the same file that DO NULL-check: :494, :614-615,
  :682-683, :1228-1229, :1400-1401, :1492-1493 — the omission here is an
  outlier, not a convention.
* Relation to DF-1496: DF-1496 = `ucSclkEntryNum` unbounded count overflow
  (requires the table to exist). DF-4292 = table-missing NULL deref
  (panics one step earlier). Different input condition, different guard.

## Impact

Boot/module-load Fatal trap 12 NULL-deref panic (CWE-476) on
VEGAM/Polaris with a crafted/defective VBIOS. Low (DF-1496 already
covers the worse overflow in this function; this is the cheap companion
guard). Not runnable on this guest (no AMD dGPU); trace-certain.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.