# PoC DF-1453: radeon_legacy_tv_dac_mode_set NULL deref via unguarded enc_priv

**Class:** NULL pointer dereference (DoS)
**Cited site:** `sys/dev/drm/radeon/radeon_legacy_encoders.c:1159, 1192, 1207`

## Reproduction status

HW/module gated — **cannot be live-triggered on the audit QEMU guest.**

No — radeon DRM is a loadable module and only attaches to ATI/AMD Radeon GPUs. No Radeon HW in the audit guest; trigger requires a Radeon card with a missing/empty CompassionateData TV DAC table.

The bug is **confirmed at the source level** by tracing the cited path:line in
`sys/dev/drm/radeon/radeon_legacy_encoders.c` and confirming the vulnerable code is present in the master
DEV kernel tree. The `fix.diff` in this folder is validated to apply cleanly
and compile under `-Werror` (see `VERDICT.md`).

## Mechanism

Line 1159 `tv_dac = radeon_encoder->enc_priv;` is assigned from radeon_atombios_get_tv_dac_info, which returns NULL when the CompassionateData table is absent or kzalloc fails. Lines 1192 (`tv_dac->tv_std`) and 1207 (`tv_dac->ps2_tvdac_adj`) deref tv_dac with no NULL guard. NULL deref → kernel panic on mode set.

## Realistic impact ceiling

panic (DoS)

## Fix

Add `if (tv_dac == NULL) { DRM_ERROR(...); return; }` immediately after the assignment.

See `fix.diff` for the git-apply-able patch.

## How to validate the fix

```
# 1. Apply fix.diff against the in-guest source:
scp -F dfbsd-qemu/config fix.diff dfbsd:/root/DF-1453.diff
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src && patch -p1 < /root/DF-1453.diff'

# 2. Rebuild the affected module (preferred) or a single-fix kernel:
ssh -F dfbsd-qemu/config dfbsd 'cd /usr/src/sys/sys/dev/drm/radeon && make'

# 3. The compile must succeed with -Werror (it does — see build.log).
```