# DF-4886 — phm_start_thermal_controller: the only phm_* dispatcher in hardwaremanager.c without PHM_FUNC_CHECK (DF-1913/DF-4831 family)

File: `sys/dev/drm/amd/powerplay/hwmgr/hardwaremanager.c:234-253`

## What

Every public wrapper in hardwaremanager.c opens with `PHM_FUNC_CHECK(hwmgr)`
(hardwaremanager.c:33-37: `if ((hw) == NULL || (hw)->hwmgr_func == NULL)
return -EINVAL;`) — every one except `phm_start_thermal_controller`, which:

1. dereferences `hwmgr` at :238 (`struct amdgpu_device *adev = hwmgr->adev;`)
   with no NULL test on `hwmgr` itself;
2. dereferences `hwmgr->hwmgr_func` at :240
   (`if (hwmgr->hwmgr_func->get_thermal_temperature_range)`) with no NULL
   test on `hwmgr_func`;
3. writes through the unchecked `adev` at :249-250
   (`adev->pm.dpm.thermal.min_temp/max_temp = ...`).

A NULL `hwmgr_func` (or NULL `hwmgr`) reaching this function is an
immediate kernel NULL-pointer dereference → panic (local DoS class at
worst; no controllable write).

## Why latent (not reachable today — proven)

- Callers of `phm_start_thermal_controller`: `hwmgr_hw_init`
  (hwmgr/hwmgr.c:249) and `hwmgr_resume` (hwmgr/hwmgr.c:321).
- On the `hwmgr_hw_init` path, the DF-1913 site (hwmgr.c:214-216,
  `!hwmgr->hwmgr_func->backend_init` deref) fires *first* for any NULL
  `hwmgr_func` — the wrapper's missing guard is shadowed.
- `hwmgr_resume` gates only on `!hwmgr || !hwmgr->pm_en` (hwmgr.c:309-311),
  but `pm_en` can only be true after `pp_early_init` → `hwmgr_early_init`
  (hwmgr.c:80-177) succeeded, and every chip-family case there assigns
  `hwmgr->hwmgr_func` via `smu7/smu8/vega10/vega12/vega20/smu10
  _init_function_pointers()` / `*_hwmgr_init()` (smu7_hwmgr.c:5140,
  smu8_hwmgr.c:2005, vega10_hwmgr.c:4992, vega12_hwmgr.c:2422,
  vega20_hwmgr.c:3604, smu10_hwmgr.c:1225) — unknown ASICs hit a
  `default: return -EINVAL` and `pp_early_init` propagates it
  (amd_powerplay.c:85-87), aborting the probe before hw_init/resume can run.

So: same class as DF-1913 (Info) and DF-4831 (Info) — a latent
NULL-discipline hole that only a *future* chip path leaving `hwmgr_func`
NULL with `pm_en` true (or memory corruption) could arm. Mirror-the-guard
one-line fix.

## Reproduce

Not runnable on the audit guest: requires an AMD GPU driven by powerplay
(guest PCI tree has no AMD device — see env.txt). Static finding,
code-certain by inspection.

## Fix

Add `PHM_FUNC_CHECK(hwmgr);` as the first statement of
`phm_start_thermal_controller` (and optionally NULL-check `adev`).