# DF-4034 — `radeon_connector_get_edid()` dereferences `ddc_bus->has_aux` with `ddc_bus == NULL`

**File:** `sys/dev/drm/radeon/radeon_connectors.c`
**Severity:** Low (unprivileged local DoS panic; hardware/BIOS-gated)
**Class:** CWE-476 NULL pointer dereference.

## Root cause (path:line)

```c
309:	if ((radeon_connector_encoder_get_dp_bridge_encoder_id(connector) !=
310:	     ENCODER_OBJECT_ID_NONE) &&
311:	    radeon_connector->ddc_bus->has_aux) {
```

The DP-bridge test (possible encoders contain TRAVIS/NUTMEG — static BIOS data) is
evaluated *first*; `ddc_bus->has_aux` is then dereferenced unconditionally. A DP-bridge
connector whose i2c bus lookup **failed** is still created with `ddc_bus == NULL`
(`radeon_add_atom_connector`, radeon_connectors.c:1961-1966: lookup failure only prints
"DP: Failed to assign ddc bus!" and continues). Every later
`radeon_connector_get_edid()` — i.e. every detect/get_modes — then panics at :311.

A second, narrower variant sits in the DP/eDP branch at :318-320
(`radeon_connector->ddc_bus->has_aux` evaluated after `dig->dp_sink_type` is set to
DISPLAYPORT by `radeon_dp_detect`, radeon_connectors.c:1709/1721) — the `else if`
at :323 shows the author *did* remember the NULL check for the non-aux path, proving
the :311/:320 dereferences are oversights.

Reachability: **unprivileged** — `DRM_IOCTL_MODE_GETCONNECTOR` has no master/auth gate
(sys/dev/drm/drm_ioctl.c:663, `DRM_UNLOCKED` only) and drives
`fill_modes → radeon_*_get_modes → radeon_connector_get_edid`. Preconditions: radeon KMS
+ a DP-bridge (Travis/Nutmeg) connector + failed i2c-bus assignment (error is visible in
dmesg at boot: "Failed to assign ddc bus!").

## Upstream status

Identical dereference in current Linux master (upstream
`radeon_connectors.c:271-273`). Unfixed upstream.

## Verification (this pack)

* `conn_probe.c` mode `getconnector` — raw unauthenticated GETCONNECTOR loop over all
  connectors (builds clean on the guest; run.log).
* Runtime hardware-gated (no radeon GPU on the audit guest — env.txt); the dereference is
  source-certain given the boot-time misconfiguration.

## Suggested fix

`fix.diff`: add `radeon_connector->ddc_bus &&` before both `has_aux` tests.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.