NULL pointer dereference in CISTPL_CFTABLE_ENTRY handler when no CISTPL_CONFIG precedes it

Summary

pccard_parse_cis_tuple dereferences state->default_cfe (NULL) at :907 when CISTPL_CFTABLE_ENTRY (0x1B) tuple is parsed before any CISTPL_CONFIG tuple. default_cfe initialized NULL by bzero at :81 only set non-NULL inside CISTPL_CONFIG case at :867. CFTABLE_ENTRY case has NO top-of-case guard immediately reaches if(num!=state->default_cfe->number) at :907 dereferencing NULL. Second related NULL deref at :916 STAILQ_INSERT_TAIL when state->pf is NULL reachable after CISTPL_END resets pf=NULL at :648. Attacker: physical PC Card/CardBus insertion malicious PCI bridge or PCI passthrough into VM. Crafted CIS begins with CFTABLE_ENTRY before CONFIG. Reliable local DoS deterministic kernel panic no user account required.