BUILD_EXIT=0
=== DF-1781 drm_mode_setcrtc uninit connector_set harness ===
crtc_req->count_connectors = 4
loop fails at i=1 (EFAULT/ENOENT)
slots [2..3] never touched -> still heap residue
  i=1: bail to out: cs[1]=NULL set
  cleanup[0]: cs[i]=0x7fffffdfd998 non-NULL -> drm_connector_put derefs base->refcount at 0x7fffffdfd99c (WILD)
  cleanup[1]: cs[i]=NULL -> skipped
  cleanup[2]: cs[i]=0xaaaaaaaaaaaaaaaa non-NULL -> drm_connector_put derefs base->refcount at 0xaaaaaaaaaaaaaaae (WILD)
  cleanup[3]: cs[i]=0xaaaaaaaaaaaaaaaa non-NULL -> drm_connector_put derefs base->refcount at 0xaaaaaaaaaaaaaaae (WILD)

VERDICT: BUG CONFIRMED. kmalloc_array without M_ZERO leaves
        slots past the failure index as heap residue. The
        cleanup loop at drm_crtc.c:761-766 reads every slot
        and calls drm_connector_put on non-NULL garbage,
        dereferencing wild pointers. Fix: kcalloc / M_ZERO.
RUN_EXIT=0