# DF-3854 — `rev = RBIOS8(offset)` executed before `if (offset)` → NULL-deref panic

## Verdict (one line)
**CONFIRMED REAL by source trace; harness replicates the exact deref order and
dies with SIGSEGV. Kernel-side panic NOT observable on the audit guest (no
radeon GPU, no IGP board) — `inconclusive`.**

## Build / run
```
./build.sh    # cc -O2 -Wall -o harness harness.c
./run.sh      # runs the harness, records the SIGSEGV
```

## Expected output
```
== DF-3854: IGP board, ROM unreadable -> rdev->bios == NULL ==
r100_init: pre-AVIVO, radeon_get_bios() failed, driver continues
...
combios_get_table_offset(TMDS_POWER_ON) = 0x0000 (NULL bios -> 0, radeon_combios.c:131)
executing radeon_combios.c:2890:  rev = RBIOS8(offset);  i.e. bios[0] with bios == (nil) ...
harness exit=139 (139=128+11 SIGSEGV => in-kernel: page fault on NULL -> panic)
```

## Preconditions (all three source-cited)
1. `rdev->bios == NULL`: `r100.c:4056-4059` deliberately continues after
   `radeon_get_bios()` failure on pre-AVIVO ASICs.
2. `rdev->flags & RADEON_IS_IGP` (RS100/RS200/RS300/RS400/RS480).
3. An external-TMDS encoder reaches mode set: forced connector table
   (root module param `radeon.connector_table=` selecting CT_POWERBOOK_EXTERNAL /
   CT_MINI_EXTERNAL / CT_MAC_X800 / CT_MAC_G5_9600 — the no-BIOS fallback path —
   radeon_combios.c:1447-1528) or a PPC Mac auto-table; then
   `radeon_legacy_encoders.c:985` calls `radeon_combios_external_tmds_setup()`.

Low severity: needs a dead ROM on an IGP board plus a root-forced (or
Mac-specific) connector table; impact is a NULL-page kernel panic (boot/mode
set DoS), not corruption.