# DF-3979 — dcn10: unchecked `event_source` deref in per-frame CRTC reset (dead path; DF-3948 twin)

**File**: `sys/dev/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c:1406`
**Severity**: Info (dead path today — same classification as DF-3948, the dce110 twin)
**Hardware**: DCN10 (Raven/Raven2) — absent from the audit guest; source-level certainty.

`dcn10_enable_per_frame_crtc_position_reset()` passes
`grouped_pipes[i]->stream->triggered_crtc_reset.event_source->status.primary_otg_inst`
straight into `tg->funcs->enable_crtc_reset(...)`. `event_source` is NULL for a
stream whose `triggered_crtc_reset.enabled` is true but whose master was never
assigned. Upstream Linux removed this deref by v5.4 (passes `0`).

**Why dead in this tree**: `triggered_crtc_reset.enabled` has no producer —
`dm_enable_per_frame_crtc_master_sync()` (amdgpu_dm.c:2835-2852) only reads
`.enabled` (the VSDB multisync enable is a TODO) and dc_stream_state is
zero-allocated, so `enable_timing_multisync()` (dc.c:785-807) filters every
pipe at dc.c:794-795 and never reaches the hwss hook. `set_master_stream()`
(amdgpu_dm.c:2812-2833) does assign `event_source` but only runs under the
same dead flag.

**Fix**: mirror upstream v5.4 (pass 0 / drop the deref) or guard
`if (event_source == NULL) continue;`. No runtime PoC is meaningful: dead code
plus no DCN hardware in the guest.

## Files
* `df3979_event_source.c` — documentation stub (not a runnable trigger)
* `VERDICT.md`, `manifest.json`, `verdict.json`