DF-4313 — dcn10 construct() OOM error path: unchecked pp_smu (NULL-deref panic) + leaked pool
=============================================================================================

What (two defects in the dcn10_resource_pool construction error path):

 1. dcn10_resource.c:1350  `pool->base.pp_smu = dcn10_pp_smu_create(ctx);`
    The return value is NOT checked (dcn10_pp_smu_create,
    dcn10_resource.c:858-867, returns NULL on kzalloc failure).
    Construction continues, and at dcn10_resource.c:1355-1357:

        if (!dc->debug.disable_pplib_wm_range) {
                dc->res_pool = &pool->base;
                dcn_bw_notify_pplib_of_wm_ranges(dc);
        }

    debug_defaults_drv.disable_pplib_wm_range = false
    (dcn10_resource.c:536), so on every production driver
    dcn_bw_notify_pplib_of_wm_ranges() runs and dereferences
    `dc->res_pool->pp_smu` unconditionally:

        dcn_calcs.c:1399  struct pp_smu_funcs_rv *pp = dc->res_pool->pp_smu;
        dcn_calcs.c:1403  if (!pp->set_wm_ranges)      <-- NULL deref

    => GPU-probe-time NULL-deref panic under memory pressure instead of
    the graceful fallback every other allocation in construct() has.
    (dcn10_hw_sequencer.c:2303 calls the same function later, same deref.)

 2. dcn10_resource.c:1482-1497 dcn10_create_resource_pool(): when
    construct() fails (any of its many goto fail paths), destruct(pool)
    frees the pool MEMBERS but the `pool` allocation itself (kzalloc at
    :1486, sizeof(struct dcn10_resource_pool), several KB) is leaked -
    kfree(dcn10_pool) exists only in dcn10_destroy_resource_pool (:1127).

Class/impact: OOM-gated boot/probe-time kernel NULL-deref panic (CWE-476)
+ memory leak (CWE-401). Identical class to DF-4215 (dc.c construct()
OOM path, rated Low). Requires allocation failure during amdgpu DC pool
construction on a Raven-class APU - not attacker-steerable timing,
severity Low (robustness).

Reachability on this audit guest: NOT reachable - no AMD GPU (env.txt),
amdgpu never attaches. Verdict: inconclusive (code-certain,
hardware-gated).

Files:
  fix.diff    both one-line fixes (checked pp_smu -> goto fail;
              kfree(pool) on create failure); git apply --check clean
  env.txt     guest hardware-absence evidence
  verdict.json machine verdict

Manual validation path for maintainers with a Raven APU: fail-inject
kzalloc in dcn10_pp_smu_create (or boot with artificially constrained
kmem): pre-fix kernel panics in dcn_bw_notify_pplib_of_wm_ranges; post-fix
amdgpu probe fails gracefully ("DC: failed to create pp_smu!") and the
pool allocation is freed.