DF-4074 — vegam NULL mm_dep_table dereference panics (pass 2, checklist class d)

Sites: vegam_smumgr.c:340 (vegam_update_uvd_smc_table), :374 (vegam_update_vce_smc_table) Source-level finding. No executable PoC (hardware-gated); see VERDICT.md.

DF-4074 VERDICT — source-level certain, hardware-gated

Root cause

• The V1 pptable parser leaves pp_table_information->mm_dep_table = NULL whenever usMMDependencyTableOffset == 0 (process_pptables_v1_0.c:796-802) — a perfectly parseable, well-formed-but-minimal VBIOS powerplay table.
• vegam dereferences it with no NULL check: vegam_smumgr.c:340 if (table_info->mm_dep_table->count > 0) — vegam_update_uvd_smc_table() vegam_smumgr.c:374 smc_state_table.VceBootLevel = (uint8_t)(table_info->mm_dep_table->count - 1) (StablePState path) — vegam_update_vce_smc_table()
• Reachability: vegam_update_smc_table() dispatches SMU_UVD_TABLE / SMU_VCE_TABLE to these helpers; the smu7 hwmgr invokes them when UVD/VCE DPM is enabled (video encode/decode use).
• NULL kernel deref ⇒ panic (local DoS with such a VBIOS; also count-1 underflow at :374 if a table exists with count==0, but the parser asserts ucNumEntries != 0 — NULL is the realistic path).

Scope discipline

• :1217 / :1330 (populate vce/uvd level) also deref mm_table, but those FUNCTIONS are DF-1366/67 — only their NULL aspect shares this root; not re-filed.
• vddc_lookup_table NULL at :515 is inside DF-1368's function — excluded.

Fix

NULL-guard in both helpers (return 0 with a dev_info, matching the polaris-family fix pattern).

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.