# DF-1267 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** certain

## Finding
NULL dereference in drm_pick_cmdline_mode when drm_mode_create_from_cmdline_mode fails under OOM

## Source Location
sys/dev/drm/drm_fb_helper.c:2176-2178

## Verdict
Source-confirmed: NULL dereference in drm_pick_cmdline_mode when drm_mode_create_from_cm. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
drm_pick_cmdline_mode at drm_fb_helper.c:2176-2178: mode=drm_mode_create_from_cmdline_mode(dev,cmdline_mode) then list_add(&mode->head,...) with NO NULL check. drm_mode_create_from_cmdline_mode returns NULL on OOM (drm_modes.c:1611-1612). &mode->head near-NULL -> list_add writes through it -> page fault panic. Trigger: video= cmdline mode + OOM + display hotplug/lastclose. Fix: if(!mode) return NULL.