# DF-3980 — VERDICT

**Status**: `inconclusive` (hardware-gated — no DCN10 GPU on the audit guest;
additionally the defect is unreachable by construction today), source certainty
only.

**Root cause**: `hwss1_plane_atomic_disconnect()` at
sys/dev/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c:889 dereferences
`opp` (`&(opp->mpc_tree_params)` and subsequent `get_mpcc_for_dpp` /
`remove_mpcc` through that pointer) before the NULL guard at :897
(`if (opp != NULL)`), which is therefore dead. If any future caller invokes the
hook with `pipe_ctx->stream_res.opp == NULL`, the kernel NULL-derefs at :889.

**Current callers (both safe)**:
1. `dcn10_init_hw` :1078 — assigns `pipe_ctx->stream_res.opp` at :1076 first.
2. `dcn10_apply_ctx_for_surface` :2391 — only for old pipes with
   `old_pipe_ctx->plane_state` set (:2387), which have OPP resources mapped.

**Upstream parity**: Linux v5.4 `hwss1_plane_atomic_disconnect` is
byte-identical in this respect (deref at its :986, dead check at :994) — a
carried-in latent defect, not a port regression.

**Fix**: hoist `if (opp == NULL) return;` to the top of the function (same
pattern as dcn10_wait_for_mpcc_disconnect :2579-2580 in this file).

**Classification rationale**: Info — latent NULL-deref, no reachable trigger
today, no memory corruption; filed as hardening with the exact one-line fix.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)