DF-4006 — fiji VCE/ACP/UVD level population NULL-derefs when the PowerPlay table omits usMMDependencyTableOffset

File: sys/dev/drm/amd/powerplay/smumgr/fiji_smumgr.c:1433 (VCE), :1472 (ACP), :1569 (UVD), :2374/:2407 (update paths) Class: NULL pointer dereference → kernel panic (DoS) — DF-1419/1575 family Severity: Low · Confidence: certain (source) · runtime hardware-gated

Build / Run / Expected

Same demonstrator as DF-4001 (./build.sh && ./run.sh, section === DF-4006 ===):

child took signal 11 on mm_table->count — in-kernel equivalent: page fault on NULL+offset during fiji_init_smc_table (driver attach / resume) => panic

Source chain

process_pptables_v1_0.c:796 leaves pp_table_information->mm_dep_table = NULL when the VBIOS PowerPlay table has usMMDependencyTableOffset == 0 — the parser keeps result == 0 and continues (:800-801 gates only the Powertune table on result). Nothing between the parser and fiji_init_smc_table consumes or checks mm_dep_table (smu7 only uses sclk/mclk/pcie). Then fiji_populate_smc_vce_level:1433 does table->VceLevelCount = (uint8_t)(mm_table->count); on NULL → page fault during pp_hwmgr init (device attach / resume) — a crafted-vBIOS boot-time/attach panic, same context class as DF-1419/DF-1550/DF-1610.

Fix

fix.diff (shared): NULL-check + clamp in all three populate functions (and the update paths keep the existing count>0 shape). Compile-validated via nativekernel rebuild (fix_build.log).

VERDICT — DF-4006

Status: inconclusive at runtime (hardware-gated); source-certain.

Demonstrated (run.log, section DF-4006): a NULL mm_dep_table deref faults (child took signal 11 on mm_table->count). Source chain: process_pptables_v1_0.c:794-802 initializes pp_table_information->mm_dep_table = NULL and populates it only if (powerplay_table->usMMDependencyTableOffset != 0) without failing the parse; smu7_hwmgr never touches mm_dep_table, so the NULL survives to fiji_init_smc_table → fiji_populate_smc_vce_level:1433 (table->VceLevelCount = (uint8_t)(mm_table->count)), and equivalently :1472 (ACP) / :1569 (UVD) / :2374 / :2407 (update paths). Result: page fault during pp_hwmgr init (attach/resume) from a crafted vBIOS with a zero MMDependencyTable offset — kernel panic; DF-1419/DF-1550/DF-1610 family. Privileged/physical context → Low.

Fix: fix.diff adds NULL checks (+ the DF-4002 clamps) in the three populate functions; nativekernel rebuild OK (fix_build.log), reverted.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.