# DF-3811 — intel_ddi_init() error path frees intel_dig_port while a registered DP connector still references it (OOM-gated UAF)

## File
`sys/dev/drm/i915/intel_ddi.c:3863-3895` (`intel_ddi_init`)

## Build / Run / Expected
**Not built, not run — guest has no Intel graphics** (see `env.txt`).
Hypothetical trigger on real hardware: memory exhaustion exactly when
`intel_ddi_init_hdmi_connector()`'s `intel_connector_alloc()` (intel_ddi.c:3694)
fails *after* `intel_ddi_init_dp_connector()` already succeeded on a dual-purpose
DP++/HDMI port (the common case — `init_hdmi && init_dp`). Expected: `goto err`
runs `drm_encoder_cleanup(encoder); kfree(intel_dig_port);` while the DP
connector registered inside `intel_dp_init_connector()` (drm_connector_init at
intel_dp.c:6620, `intel_connector_attach_encoder` at intel_dp.c:6634) stays in
`dev->mode_config.connector_list` holding `connector->encoder ==
&intel_dig_port->base` → use-after-free on the next hotplug, connector probe,
or `drm_mode_config_cleanup()` at unload.

## Root cause
```c
	if (init_dp) {
		if (!intel_ddi_init_dp_connector(intel_dig_port))
			goto err;                 /* nothing registered yet: this one is fine */
		intel_dig_port->hpd_pulse = intel_dp_hpd_pulse;
	}
	if (intel_encoder->type != INTEL_OUTPUT_EDP && init_hdmi) {
		if (!intel_ddi_init_hdmi_connector(intel_dig_port))
			goto err;                 /* DP connector LIVE at this point: not fine */
	}
	...
err:
	drm_encoder_cleanup(encoder);
	kfree(intel_dig_port);            /* frees object the live connector references */
```
`intel_ddi_init_hdmi_connector()` (intel_ddi.c:3688-3702) returns NULL only when
`intel_connector_alloc()` fails — its inner `intel_hdmi_init_connector()` is
void — so the window is exactly a kmalloc failure during probe on a DP+HDMI
port. Hence Low severity / OOM-gated, but the class is use-after-free.

## Impact
Kernel UAF (dereference + indirect call through freed `intel_dig_port`) on any
subsequent operation touching the surviving DP connector — HPD handling
(`encoder->hotplug` == `intel_ddi_hotplug` was installed in the freed object),
connector fill_modes/get_status, or final `drm_mode_config_cleanup`.