# DF-1974 PoC — NULL-deref in radeon_dig_monitor_is_duallink

## Trigger

Must be DRM master (root or `drmSetMaster` on `/dev/dri/card0`).

```sh
cc -O2 -Wall -o poc poc_df_1974.c -ldrm
./poc   # kernel panics in radeon_dig_monitor_is_duallink
```

The PoC issues `DRM_IOCTL_MODE_SETCRTC` against an encoder whose connector has
been removed (or that was enumerated by a malformed VBIOS without a matching
connector). The driver walks into `atombios_dig_encoder_setup2` →
`atombios_dig_transmitter_setup` → `radeon_dig_monitor_is_duallink`
(radeon_encoders.c:359), which faults at line 374/376 when both connector
lookups return NULL.

## Alternative triggers

1. **MST hot-unplug race:** PCI passthrough a radeon GPU; unplug a downstream
   MST sink from the host while the guest issues a modeset on the encoder
   that referenced it.

2. **Crafted VBIOS:** Boot the guest with a VBIOS image whose encoder table
   enumerates an encoder with no matching connector object. The fault fires
   on the first modeset attempt.

## Expected output

```
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x... (small offset near NULL)
ip = ...radeon_dig_monitor_is_duallink+0x...
```

The PoC is a local DoS only — no escalation path because the fault is at
address ~NULL, not at a controlled offset.