fm: handle all CFE_TBL_GetAddress failure codes (not just NEVER_LOADED)

[nurdymuny]

Summary

Three call sites in FM check only Status == CFE_TBL_ERR_NEVER_LOADED after CFE_TBL_GetAddress() and dereference FM_AppData.MonitorTablePtr in the else branch. Per cfe_tbl.h, the pointer is undefined on any of the other four documented failure codes — CFE_TBL_ERR_INVALID_HANDLE, CFE_TBL_ERR_NO_ACCESS, CFE_ES_ERR_RESOURCEID_NOT_VALID, CFE_TBL_BAD_ARGUMENT — so those paths reach an undefined-pointer deref.

Affected sites:

File	Function	Behaviour on non-NEVER_LOADED error
fsw/src/fm_cmds.c	FM_MonitorFilesystemSpaceCmd (line 855)	reads FM_AppData.MonitorTablePtr->Entries
fsw/src/fm_cmds.c	FM_SetTableStateCmd (line 967)	reads FM_AppData.MonitorTablePtr->Entries[Index].Type and writes .Enabled
fsw/src/fm_table_utils.c	FM_AcquireTablePointers (line 206)	leaves stale pointer for later callers

This is the same defense-in-depth shape as nasa/MM#116 (DataSize switch with no default case) — a switch / if that covers some but not all of the failure modes of an upstream API.

Change

At all three sites, invert the predicate: only CFE_SUCCESS and CFE_TBL_INFO_UPDATED are documented to set the pointer; everything else NULLs it (and for the two command handlers, also flips CommandResult false and emits the existing *_TBL_ERR_EID error event so the ground operator sees the failure).

- if (Status == CFE_TBL_ERR_NEVER_LOADED)
+ if (Status != CFE_SUCCESS && Status != CFE_TBL_INFO_UPDATED)

Provenance

Surfaced by scj-hunt + Gigi ATTEND on a fresh ingest of FM v1.2.0 into the cfs_apps_fm_v01 fiber bundle. FM_SetTableStateCmd was the rank-1 hit at risk_score 8.8; drilling its structural twins surfaced the matching pattern in the other two sites. scj-hunt is open source at nurdymuny/shadow-clone-jutsu.

Test plan

• Build under existing CI (no new symbols, no new headers)
• Mock-fault CFE_TBL_GetAddress with CFE_TBL_ERR_INVALID_HANDLE, observe FM_SET_TABLE_STATE_TBL_ERR_EID / FM_GET_FREE_SPACE_TBL_ERR_EID emitted instead of the prior undefined-pointer deref. Happy to add a unit test for this if reviewers want.

🤖 Generated with Claude Code

[nurdymuny]

FYI to reviewers: while sweeping the other cFS apps for the same shape, I found that nasa/CF::CF_CheckTables (cf_app.c:48) addresses the identical concern with an inline comment block explaining the multi-success-code issue and uses

if (status < CFE_SUCCESS) { /* error */ }

(negative-only check) on the basis that cFE convention is "alt-success codes are positive, errors are negative".

If you'd prefer that idiom over the explicit allow-list in this PR (Status != CFE_SUCCESS && Status != CFE_TBL_INFO_UPDATED), I'm happy to switch. CF's approach is shorter and more future-proof against new info codes; the explicit allow-list is more conservative about what it accepts.

Sister PR with the same root cause: nasa/SC#170.