# DF-3980 — dcn10: `opp` NULL check placed after its dereference in hwss1_plane_atomic_disconnect (latent)

**File**: `sys/dev/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c:889,897`
**Severity**: Info (latent — currently unreachable; upstream-identical)
**Hardware**: DCN10 — absent from the audit guest; source-level certainty.

`hwss1_plane_atomic_disconnect()` reads `pipe_ctx->stream_res.opp` into a
local at :887, dereferences it at :889 (`&(opp->mpc_tree_params)`, then
`get_mpcc_for_dpp`/`remove_mpcc` on that pointer), and only *afterwards*
tests `if (opp != NULL)` at :897 before touching it again. The check is dead
code: it can never protect the earlier dereferences.

**Unreachable today**: the two callers both guarantee a non-NULL OPP —
`dcn10_init_hw` sets `pipe_ctx->stream_res.opp = dc->res_pool->opps[i]`
(:1076) immediately before invoking the hook (:1078), and
`dcn10_apply_ctx_for_surface` calls it only for old pipes that had a plane
attached (:2387-2391), which by resource mapping have stream_res.opp
assigned. Upstream Linux v5.4 carries byte-identical code, so a future caller
that relaxes the invariant trips the NULL deref.

**Fix**: hoist the check to the top of the function
(`if (opp == NULL) return;`) — matching the style of `dcn10_wait_for_mpcc_disconnect`'s
`if (!pipe_ctx->stream_res.opp) return;` (:2579-2580).

## Files
* `df3980_opp_order.c` — documentation stub
* `VERDICT.md`, `manifest.json`, `verdict.json`