# DF-3948 — dce110_enable_per_frame_crtc_position_reset(): unguarded NULL event_source deref (currently dead path)

**Severity:** Info (latent; dead API today — same family as DF-3944/DF-1300)
**CWE-476**

## Bug

`sys/dev/drm/amd/display/dc/dce110/dce110_hw_sequencer.c:2320`:

```c
	gsl_params.gsl_master = grouped_pipes[0]->stream->triggered_crtc_reset.
		event_source->status.primary_otg_inst;
```

`event_source` is dereferenced with no NULL check. The producer-side
scaffolding is already wired and *can assign NULL*:
`amdgpu_dm.c:2816-2833 set_master_stream()` does
`stream_set[j]->triggered_crtc_reset.event_source = stream_set[master_stream];`
where `master_stream` starts at 0 — if `stream_set[0]` is NULL (slot holes
are possible: the loop skips NULL entries), **every** stream gets
`event_source == NULL`. The only gate is
`dc.c:786-799 enable_timing_multisync()`, which selects pipes whose
`triggered_crtc_reset.enabled` is true — and grep-verified **no code in this
tree ever sets `.enabled = true`** (`rg 'triggered_crtc_reset.enabled *='`
returns nothing; the amdgpu_dm TODO at :2845 says the VSDB parser that would
set it is unimplemented). dcn10_hw_sequencer.c:1406 has the identical
unguarded pattern.

So today the path is unreachable (dead), but it is one unfinished feature
away from a NULL-deref panic reachable by `dc_commit_state` (dc.c:979).
Filed as Info hardening: add the NULL check now (or assert both).

## Fix

```diff
-	gsl_params.gsl_master = grouped_pipes[0]->stream->triggered_crtc_reset.event_source->status.primary_otg_inst;
+	if (!grouped_pipes[0]->stream->triggered_crtc_reset.event_source)
+		return;
+	gsl_params.gsl_master = ...same...;
```

Verification: untested (Info, dead path, hardware-gated); source-certain.