# DF-4033 — NULL `radeon_encoder` dereference family in connector property handlers and monitor-bpc path

**File:** `sys/dev/drm/radeon/radeon_connectors.c`
**Severity:** Low (local DoS panic; DRM_MASTER-gated for the property paths, misconfiguration-gated)
**Class:** CWE-476 NULL pointer dereference.

## Root cause (path:line)

Three property handlers and one bpc helper obtain the encoder via
`connector_funcs->best_encoder(connector)` (when `connector->encoder == NULL`) and then
dereference the result without a NULL check:

* `radeon_connector_set_property()` scaling-mode block — deref at
  `radeon_connectors.c:733` (`radeon_encoder->rmx_type`) and `:737`
  (`->native_mode.clock`); encoder from :719-724.
* `radeon_connector_set_property()` output-csc block — deref at
  `radeon_connectors.c:753` (`radeon_encoder->output_csc`); encoder from :746-751.
* `radeon_lvds_set_property()` — deref at `radeon_connectors.c:972`/`:975`;
  encoder from :958-963.
* `radeon_get_monitor_bpc()` LVDS/eDP branch — deref at
  `radeon_connectors.c:163-165` (`dig = radeon_encoder->enc_priv; dig->lcd_misc`);
  encoder from :161 (`radeon_best_single_encoder` returns NULL on an empty
  possible-encoder list).

`best_encoder` is `radeon_dvi_encoder` for DVI/DP connectors
(radeon_connectors.c:1453-1478), which **returns NULL when the connector's
possible-encoder list is empty** (all three loops fall through to `return NULL` at :1477),
and `radeon_best_single_encoder` (:379-389) returns NULL in the same situation. Empty
possible-encoder lists occur on connector-table/BIOS misconfigurations and on partially
failed connector bring-up (the same class of misconfiguration that DF-1343/DF-1344
depend on).

Reachability: `DRM_IOCTL_MODE_SETPROPERTY`/`MODE_OBJ_SETPROPERTY` are `DRM_MASTER`
(sys/dev/drm/drm_ioctl.c:667,679) — i.e. the X server/compositor or any process that
acquires master on an unclaimed device; the bpc path is reached from modesets
(`atombios_crtc.c:987`, `atombios_dp.c:310`, `evergreen.c:1290`, `r600.c:299`,
`rs600.c:164`, `cik.c:8770`). Impact: kernel NULL-deref panic (local DoS).

## Upstream status

Upstream Linux master has the identical missing guards (verified against the master file:
no `if (!radeon_encoder)` after any of the four sites). Unfixed upstream.

## Verification (this pack)

* `conn_probe.c` mode `setprop` — raw `DRM_IOCTL_MODE_OBJ_SETPROPERTY` probe of the
  connector-property surface (builds clean on the guest; run.log).
* Runtime hardware-gated (no radeon GPU on the audit guest — env.txt); the dereference
  itself is source-certain given an empty possible-encoder list.

## Suggested fix

`fix.diff`: NULL-check `radeon_encoder` (three property sites) and NULL-check
encoder/enc_priv in `radeon_get_monitor_bpc`.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.