# DF-5357 — pccard_driver_added NULL-deref panic on kldload after a CIS-error card

## What
`pccard_driver_added()` (`sys/bus/pccard/pccard.c:1074-1103`):

```c
1081  STAILQ_FOREACH(pf, &sc->card.pf_head, pf_list) {
1082      if (STAILQ_EMPTY(&pf->cfe_head))
1083          continue;
1084      child = pf->dev;
1085      if (device_get_state(child) != DS_NOTPRESENT)   /* child == NULL! */
```

`pf->dev` is NULL whenever `pccard_attach_card()` bailed out early — the
`sc->card.error` return at `pccard.c:205-208` (e.g. CFTABLE "too many io/mem
spaces", memspace length 0/lengthsize 0 — `pccard_cis.c:1047-1055,1167-1175,
1185-1203`) or "Card has no functions" at `pccard.c:209-212`. Functions and
their cfe lists were already parsed into `pf_head`, but children are only
created further down (`pccard.c:253-259`).

`device_get_state()` is `return(dev->state);` (`sys/kern/subr_bus.c:1824-1827`)
— NULL + offsetof(struct device, state) dereference → kernel panic.

## Trigger
1. Insert a card whose CIS sets `card->error` (many single-tuple ways, e.g. a
   CISTPL_CFTABLE_ENTRY with 5 io ranges after a valid CISTPL_CONFIG).
2. `kldload` any module registering a driver on the pccard bus
   (`devclass_add_driver` → `bus_generic_driver_added` → `pccard_driver_added`).

kldload requires root, hence Low severity (root-triggered local panic /
defense-in-depth). All in-tree pccard clients are compiled into GENERIC, so
the realistic trigger is an out-of-tree or custom-built client module.

## Fix
`if (pf->dev == NULL) continue;` before the state check — fix.diff.