# DF-5067 — power_state_management() NULL-checks pcurrent then dereferences it anyway (latent NULL-deref)

## Build
Not buildable/runnable on the audit guest: requires an AMD GPU (amdgpu attach) for
`power_state_management()` to execute. The guest has only QEMU std VGA
(chip=0x11111234) and /dev/dri does not exist (see env.txt).

## Run
N/A — see env.txt for the documented hardware-absence evidence.

## Expected behavior if the latent path ever becomes reachable
With `hwmgr->ps != NULL` but `hwmgr->current_ps == NULL` (any future writer that
breaks the current allocate-together/free-together invariant):
- pp_psm.c:248 passes NULL into `phm_apply_state_adjust_rules()`, whose smu8 backend
  dereferences it unconditionally at smu8_hwmgr.c:1044-1045
  (`cast_const_smu8_power_state(&pcurrent_ps->hardware)`) and reads
  `smu8_current_ps->action` at smu8_hwmgr.c:1066 → kernel NULL-deref panic
  (CZ/Stoney Ridge APUs).
- Independently, pp_psm.c:254 `phm_set_power_state(hwmgr, &pcurrent->hardware, ...)`
  computes `&((struct pp_power_state *)NULL)->hardware` (small constant address) and
  hands it to the backend on every ASIC → fault.

## Fix
Apply fix.diff (early-return when current_ps is NULL). The fix also protects the
pass-through at :248, which the old `pcurrent == NULL` check at :249 never covered.