Fixes #38569

Target Release

1.16.x

Rollback Plan

• If a change needs to be reverted, we will roll out an update to the code within 7 days.

Changes to Security Controls

None.

CHANGELOG entry

• This change is user-facing and I added a changelog entry.

Root cause

cty.Value.GetAttr asserts the value's internal representation to map[string]interface{}; that assertion panics on cty.NullVal(...) because the representation is nil. Two functions in internal/genconfig/generate_config.go — writeConfigNestedTypeAttributeFromExisting and writeConfigBlocksFromExisting — called GetAttr on the incoming parent value without first checking IsNull(). In the terraform query -generate-config-out flow, generateHCLListResourceDef (in internal/terraform) deliberately hands genconfig cty.NullVal(schema.Body.ImpliedType()) whenever the provider returned no state for a queried resource, which made the panic reachable from real usage.

Fix

Add an IsNull() guard before each problematic GetAttr call. In writeConfigNestedTypeAttributeFromExisting the guard emits a literal null for the attribute when the parent is null, mirroring the existing handling for null primitives in writeConfigAttributesFromExisting (which falls back to attrS.EmptyValue() for the same situation) and the per-nesting nestedVal.IsNull() branches further down in the same function. In writeConfigBlocksFromExisting the guard short-circuits the iteration because writeConfigNestedBlockFromExisting already treats a null block value as "nothing to emit". The diff stays inside internal/genconfig.

Regression test

Adds two table-driven cases to TestConfigGeneration in internal/genconfig/generate_config_test.go:

• resource_with_null_state constructs cty.NullVal(...) as the resource state and exercises every nested-type nesting mode (single/list/map) plus a nested block, asserting that generation completes without panic and emits well-formed HCL.
• resource_with_nested_value_sibling covers the inverse: a non-null parent with real nested values, to guard against the new null guard becoming too eager and silently dropping data.

Both tests construct the cty.Value directly — no provider, no network, no CLI invocation.

No public API changes

The change is internal to internal/genconfig. No exported symbols, function signatures, or behaviours for non-null inputs are altered.