# DF-3957 — radeon atombios_encoders.c unguarded `enc_priv` derefs (NULL-page read **and write**)

**File:** `sys/dev/drm/radeon/atombios_encoders.c` (pass 2, GLM 5.3; pass 1: no findings)
**Severity:** Low · **CWE:** CWE-476 · **Confidence:** likely
**Status:** inconclusive on guest (no AMD GPU); offset-arithmetic simulation harness verified.

## What

`radeon_add_atom_encoder()` assigns `enc_priv = radeon_atombios_get_lvds_info()`
for LCD-supporting encoders (:2834-2838 LVDS family, :2868-2872 UNIPHY family).
That function (radeon_atombios.c:1617-1755) returns **NULL** when the VBIOS
`LVDS_Info` DATA table is missing (`atom_parse_data_header` fails) or on
kzalloc failure — while the connector table still advertised
`ATOM_DEVICE_LCD_SUPPORT`. Several hot paths then dereference `enc_priv`
without a NULL check (contrast the guards that DO exist at :100, :240, :629,
:2551):

| Site | Function | Access |
|---|---|---|
| :742-744 | `atombios_get_encoder_mode` | read `active_mst_links` (NULL+8) |
| :1085 | `atombios_dig_transmitter_setup2` | read `dig_encoder` (NULL+0) — **boot**, via `radeon_atom_encoder_init` :2314 |
| :1695-97 | `radeon_atom_encoder_dpms_avivo` | read `backlight_level` (arg evaluation) |
| :1744 | `radeon_atom_encoder_dpms_dig` | **write** `panel_mode` (NULL+12) |
| :1783 | `radeon_atom_encoder_dpms_dig` | read `backlight_level` |
| :1796 | `radeon_atom_encoder_dpms_dig` | read `active_mst_links` |
| :2006-07 | `atombios_set_encoder_crtc_source` | read `dig_encoder` |
| :2270-72 | `radeon_atom_pick_dig_encoder` | read `dig_encoder` (any digital encoder) |
| :2661-63 | `radeon_atom_encoder_disable` | read + **write** `dig_encoder = -1` (NULL+0) |

All faults land in the NULL page → kernel page fault → **panic** at
boot/mode-set. Upstream Linux radeon carries the identical unguarded paths
(inherited defect); trigger is hardware+VBIOS-gated (eDP/LVDS connector in the
BIOS connector table but no/short LVDS_Info table — seen in the wild on odd
laptop BIOSes — or boot-time OOM).

## Reproduce

```
cd findings/poc/DF-3957
./build.sh          # cc -O2 -Wall -o trigger_df3957 trigger_df3957.c
./run.sh
```

Expected (crash mode): both children SIGSEGV sig=11 — child1 the
`dig->dig_encoder` read-then-write-`-1` (:2661-2663), child2 the
`dig->panel_mode` write (:1744); `RESULT: NULL-PAGE FAULTS AS PREDICTED (rc=0)`.

## Fix

NULL-guard the sinks, matching the guards already present elsewhere in the
file (fix.diff).